This string suggests FinSpy, a product of Gamma International [27]. The executables used virtualized obfuscation [28], which appeared to be custom-designed. We devised a fingerprint for the obfuscater and located a structurally