rule CryptONE_1111111Version {
	meta:
		Author = "SentinelLabs"
		Family = "Evil Corp CryptOne"
	strings:
		$str1 = "111111111\\{aa5b6a80-b834-11d0-932f-00a0c90dcaa9}" ascii wide
		$str2 = "111111111\\{b196b287-bab4-101a-b69c-00aa00341d07}" ascii wide
	condition:
		any of them
}