26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 67:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T493,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Barys.Generic Sample 58edf3294603… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 58edf3294603…. Malware family: Barys.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 15 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/58edf329460394faceb5b2331f16f2bb2ae79e904e6ebf20a45a89bce619a0e9","keywords":["Malicious","Barys.Generic","malware analysis","sandbox report","threat intelligence","58edf329460394faceb5b2331f16f2bb2ae79e904e6ebf20a45a89bce619a0e9"],"about":{"@type":"SoftwareApplication","name":"cryptojacking.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"58edf329460394faceb5b2331f16f2bb2ae79e904e6ebf20a45a89bce619a0e9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Barys.Generic","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":15,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T690,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006608.00000000.144294.308C0000.00000004.mdmp, 00000000-00006608.00000000.144294.4AB50000.00000004.mdmp, 00000000-00006608.00000001.144558.308C0000.00000004.mdmp") Found string "5941\System.Management.Automation.ni.dll" (Source: "00000000-00006608.00000000.144294.308C0000.00000004.mdmp, 00000000-00006608.00000001.144558.308C0000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00006608.00000000.144294.308C0000.00000004.mdmp, 00000000-00006608.00000001.144558.308C0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00006608.00000000.144294.308C0000.00000004.mdmp, 00000000-00006608.00000001.144558.308C0000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found string "WS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp")28:T9f5,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp")29:Td91,Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp")2a:Tdfc,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp, 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp, 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp")2b:T7cd,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp, 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp, 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp")2c:T4ab,Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp")2d:T6b8,Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00000928.00000000.148054.0DA61000.00000040.mdmp Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00000928.00000000.148054.0DA61000.00000040.mdmp Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00001816.00000000.148702.F5C56000.00000002.mdmp Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00001816.00000000.148702.F5C56000.00000002.mdmp Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00003128.00000000.148378.90170000.00000040.mdmp Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00003128.00000000.148378.90170000.00000040.mdmp Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00003320.00000000.147180.88C96000.00000002.mdmp Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00003320.00000000.147180.88C96000.00000002.mdmp Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00004132.00000002.146867.92666000.00000002.mdmp Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00004132.00000002.146867.92666000.00000002.mdmp Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00005656.00000000.147402.07E61000.00000040.mdmp Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00005656.00000000.147402.07E61000.00000040.mdmp Observed string: ":\WINDOWS\SYSTEM32\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00006608.00000000.144294.4AB50000.00000004.mdmp 00000000-00006608.00000001.144558.4AB50000.00000004.mdmp2e:Tb1f,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{000C10F1-0000-0000-C000-000000000046}") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{000C10F1-0000-0000-C000-000000000046}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{06C9E010-38CE-11D4-A2A3-00104BD35090}") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{06C9E010-38CE-11D4-A2A3-00104BD35090}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTSIPDLLPUTSIGNEDDATAMSG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS")2f:Ta1c,"cryptojacking.exe" queried SystemProcessInformation at 00000000-00004132-00000C15-1197657455 [PID: 4132] "cryptojacking.exe" queried SystemProcessInformation at 00000000-00004132-00000C15-1197666036 [PID: 4132] "cryptojacking.exe" queried SystemProcessInformation at 00000000-00004132-00000C15-1197901788 [PID: 4132] "cryptojacking.exe" queried SystemProcessInformation at 00000000-00004132-00000C15-1197910467 [PID: 4132] "cryptojacking.exe" queried SystemProcessInformation at 00000000-00004132-00000C15-1198164722 [PID: 4132] "cryptojacking.exe" queried SystemProcessInformation at 00000000-00004132-00000C15-1198175755 [PID: 4132] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1214142682 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1214151691 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1215746858 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1215758115 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1216691630 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1216699925 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1217017243 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1217025376 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1217293424 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1217341943 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1218134960 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1218977557 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1218990125 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1219412865 [PID: 6608] "powershell.exe" queried SystemProcessInformation at 00000000-00006608-00000C15-1219420923 [PID: 6608] "cmd.exe" queried SystemProcessInformation at 00000000-00006044-00000C15-1223617393 [PID: 6044] "cmd.exe" queried SystemProcessInformation at 00000000-00006044-00000C15-1223624464 [PID: 6044] "cmd.exe" queried SystemProcessInformation at 00000000-00006044-00000C15-1224088728 [PID: 6044] "cmd.exe" queried SystemProcessInformation at 00000000-00006044-00000C15-1224096724 [PID: 6044]30:T6d6,Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001268.00000000.147183.69AD0000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00001268.00000000.147183.69AD0000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001268.00000000.147183.69AD0000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00001268.00000000.147183.69AD0000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00002212.00000000.146852.08050000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp, 00000000-00004132.00000002.146867.92320000.00000004.mdmp") Found api reference "CryptBinaryToStringW" (Indicator: "CryptBinaryToStringW"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found api reference "CryptStringToBinaryW" (Indicator: "CryptStringToBinaryW"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp")31:T42f,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content)32:T16c9c,Found XOR loop in file "updater.exe" at offset 13718; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 44046; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 51362; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 92654; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 136722; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 139298; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 149442; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 163543; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 184770; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 195362; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 206410; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 211866; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 212678; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 232174; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 244887; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 247918; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 251299; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 272822; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 273286; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 286895; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 300258; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 311322; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 322298; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 324654; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 340030; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 340078; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 365994; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 368974; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 379550; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 381858; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 391642; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 395043; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 399146; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 399534; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 414954; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 437396; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 441694; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 448114; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 458934; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 464010; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 477494; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 483298; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 495038; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 504530; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 530179; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 552842; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 572270; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 575954; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 582234; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 585078; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 591574; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 605402; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 638362; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 643134; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 662210; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 664354; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 692414; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 700910; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 714122; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 743702; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 753470; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 757470; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 757478; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 769086; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 785106; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 804274; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 806862; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 807402; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 811046; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 814658; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 823694; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 837670; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 838814; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 845214; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 865374; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 892034; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 935670; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 937670; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 948966; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 949434; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 958226; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 987102; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1002398; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1018690; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1023482; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1025922; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1040710; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1047618; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1062098; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1077170; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1083326; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1084302; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1084830; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1095642; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1102082; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1105674; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1106510; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1109094; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1114774; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1120122; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1121470; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1122726; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1126186; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1126606; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1133086; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1133750; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1135390; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1139110; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1139582; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1141874; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1149762; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1150322; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1156122; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1169382; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1176910; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1178366; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1186630; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1200626; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1205666; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1206014; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1211286; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1232238; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1239502; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1268678; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1272418; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1277626; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1294414; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1299506; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1309094; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1312066; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1316458; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1360898; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1365838; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1371826; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1374678; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1380710; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1383010; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1390618; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1395566; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1406878; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1438358; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1472558; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1479302; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1479354; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1480166; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1482098; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1500418; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1501070; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1504806; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1525822; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1554641; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1592618; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1596442; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1608182; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1616082; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1616294; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1638902; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1673946; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1684699; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1686446; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1690130; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1710390; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1722570; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1749636; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1765634; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1771674; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1777818; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1783710; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1795202; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1797166; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1824122; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1843526; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1844163; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1849634; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1850142; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1850335; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1858730; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1880646; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1887758; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1889562; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1897726; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1911266; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1913122; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1916530; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1919346; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1944402; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1946974; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1965530; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1972974; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1986990; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1989814; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2002289; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2014094; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2020611; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2040722; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2066306; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2066698; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2067862; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2072878; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2073322; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2073642; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2084866; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2090950; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2098494; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2127566; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2128662; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2147934; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2156478; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2159566; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2169878; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2173414; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2227967; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2233474; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2235754; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2249298; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2253010; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2263850; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2297150; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2303338; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2304546; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2316626; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2338226; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2349734; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2411374; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2425070; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2451958; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2459438; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2463806; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2472098; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2479050; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2483854; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2509738; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2516430; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2539066; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2540290; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2547806; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2551754; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2553562; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2589074; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2591922; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2594690; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2594734; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2601170; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2602342; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2606762; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2618478; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2624242; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2647726; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2648342; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2655786; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2657746; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2672946; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2711158; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2725663; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2741334; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2755059; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2786894; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2817798; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2821040; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2824546; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2832910; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2833981; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2837202; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2840850; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2862118; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2863838; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2863890; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2868038; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2884246; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2884522; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2922967; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2951054; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2965347; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2965518; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2968790; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2979266; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2990482; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3007422; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3008278; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3008966; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3025982; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3048591; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3061134; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3066466; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3079672; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3101946; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3102490; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3106914; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3110594; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3141942; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3160302; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3182647; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3183398; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3184054; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3197478; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3215514; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3223330; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3233506; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3240146; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3244186; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3244790; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3248758; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3266650; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3277606; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3315066; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3316950; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3318326; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3325078; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3333786; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3342446; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3344578; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3345446; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3347782; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3356174; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3356302; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3365526; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3366454; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3401294; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3414194; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3417270; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3424782; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3443134; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3469110; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3487466; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3493914; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3510202; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3515798; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3527798; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3531042; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3566538; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3595991; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3598942; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3630910; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3647742; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3649502; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3651075; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3676114; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3681534; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3689070; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3722991; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3763434; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3768526; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3774970; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3777866; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3809434; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3815106; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3849890; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3883422; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3886246; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3909554; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3920506; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3975674; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3976378; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3990306; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3996978; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4010422; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4013149; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4019246; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4029362; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4029826; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4154178; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4177226; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4214470; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4239590; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4246162; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4259902; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4270575; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4300082; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4300574; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4322779; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4328050; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4332366; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4338815; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4358363; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4373186; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4394595; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4407295; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4416410; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4426518; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4436382; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4451495; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4453594; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4459654; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4471490; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4487270; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4488190; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4500966; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4506002; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4630010; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4634950; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4725710; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4727358; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4747558; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4753446; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4755182; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4785218; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4832581; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4845455; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4853710; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4968022; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4973258; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4996882; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5020026; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5025186; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5025998; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5060566; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5081166; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5083370; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5085686; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5098850; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5100610; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5111346; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5118094; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5119082; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5119258; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5120178; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5131146; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5131310; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5137182; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5139774; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5166822; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5197302; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5221322; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5222578; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5241386; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5243506; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 117104; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 280574; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 352366; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 642158; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 754097; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 980525; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 1029207; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 1431393; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 1878997; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 1887151; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 1931495; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 2036493; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 2278010; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 2589309; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 2723403; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 3198239; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 3219128; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 3222441; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 3333001; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 3703719; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 3856135; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 3917194; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 4049691; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 4171547; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 4413711; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 4459575; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 4535723; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 4804687; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 136826; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 137093; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 204357; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 289345; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 345514; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 391686; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 475482; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 495037; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 592821; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 657032; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 726903; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 729766; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 782881; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1208959; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1215247; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1297373; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1302501; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1372405; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1457343; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1516099; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1525378; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1554423; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1565971; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1610069; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1690094; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1694366; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1720149; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1880941; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1956001; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1960021; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2036193; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2064662; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2169969; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2176154; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2182978; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2239226; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2252692; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2328429; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2365247; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2425730; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2578653; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2665573; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2747045; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2751226; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2755829; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2770749; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2800981; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2816709; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2821265; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3034929; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3182813; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3218657; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3288601; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3293430; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3355577; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3403685; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3584429; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3645957; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3672770; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3715477; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3729390; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3744789; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3763405; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3810704; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3960449; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 3978758; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4016625; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4400464; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4498535; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4524885; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4546534; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4599599; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4616270; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4671713; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4779268; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4814390; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4971269; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 5028441; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 5059169; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 5131822; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 13718; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 44046; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 51362; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 92654; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 136722; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 139298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 149442; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 163543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 184770; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 195362; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 206410; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 211866; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 212678; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 232174; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 244887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 247918; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 251299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 272822; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 273286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 286895; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 300258; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 311322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 322298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 324654; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 340030; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 340078; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 365994; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 368974; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 379550; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 381858; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 391642; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 395043; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 399146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 399534; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 414954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 437396; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 441694; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 448114; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 458934; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 464010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 477494; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 483298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 495038; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 504530; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 530179; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 552842; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 572270; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 575954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 582234; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 585078; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 591574; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 605402; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 638362; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 643134; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 662210; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 664354; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 692414; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 700910; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 714122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 743702; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 753470; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 757470; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 757478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 769086; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 785106; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 804274; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 806862; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 807402; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 811046; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 814658; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 823694; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 837670; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 838814; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 845214; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 865374; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 892034; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 935670; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 937670; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 948966; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 949434; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 958226; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 987102; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1002398; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1018690; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1023482; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1025922; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1040710; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1047618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1062098; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1077170; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1083326; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1084302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1084830; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1095642; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1102082; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1105674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1106510; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1109094; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1114774; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1120122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1121470; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1122726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1126186; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1126606; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1133086; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1133750; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1135390; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1139110; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1139582; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1141874; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1149762; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1150322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1156122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1169382; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1176910; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1178366; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1186630; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1200626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1205666; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1206014; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1211286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1232238; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1239502; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1268678; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1272418; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1277626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1294414; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1299506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1309094; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1312066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1316458; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1360898; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1365838; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1371826; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1374678; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1380710; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1383010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1390618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1395566; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1406878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1438358; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1472558; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1479302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1479354; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1480166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1482098; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1500418; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1501070; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1504806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1525822; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1554641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1592618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1596442; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1608182; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1616082; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1616294; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1638902; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1673946; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1684699; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1686446; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1690130; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1710390; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1722570; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1749636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1765634; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1771674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1777818; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1783710; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1795202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1797166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1824122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1843526; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1844163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1849634; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1850142; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1850335; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1858730; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1880646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1887758; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1889562; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1897726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1911266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1913122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1916530; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1919346; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1944402; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1946974; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1965530; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1972974; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1986990; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1989814; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2002289; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2014094; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2020611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2040722; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2066306; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2066698; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2067862; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2072878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2073322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2073642; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2084866; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090950; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2098494; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2127566; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2128662; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2147934; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2156478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2159566; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2169878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2173414; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2227967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2233474; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2235754; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2249298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2253010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2263850; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2297150; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2303338; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2304546; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2316626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2338226; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2349734; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2411374; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2425070; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2451958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2459438; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2463806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2472098; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2479050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2483854; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2509738; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2516430; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2539066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2540290; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2547806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2551754; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2553562; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2589074; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2591922; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2594690; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2594734; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2601170; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2602342; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2606762; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2618478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2624242; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2647726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2648342; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2655786; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2657746; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2672946; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2711158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2725663; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2741334; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2755059; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2786894; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2817798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2821040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2824546; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2832910; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2833981; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2837202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2840850; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2862118; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2863838; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2863890; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2868038; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2884246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2884522; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2922967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2951054; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2965347; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2965518; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2968790; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2979266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2990482; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3007422; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3008278; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3008966; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3025982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3048591; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3061134; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3066466; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3079672; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3101946; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3102490; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3106914; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3110594; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3141942; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3160302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3182647; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3183398; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3184054; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3197478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3215514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3223330; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3233506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3240146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3244186; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3244790; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3248758; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3266650; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3277606; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3315066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3316950; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3318326; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3325078; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3333786; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3342446; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3344578; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3345446; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3347782; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3356174; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3356302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3365526; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3366454; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3401294; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3414194; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3417270; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3424782; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3443134; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3469110; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3487466; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3493914; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3510202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3515798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3527798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3531042; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3566538; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3595991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3598942; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3630910; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3647742; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3649502; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3651075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3676114; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3681534; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3689070; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3722991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3763434; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3768526; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3774970; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3777866; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3809434; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3815106; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3849890; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3883422; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3886246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3909554; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3920506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3975674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3976378; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3990306; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3996978; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4010422; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4013149; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4019246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4029362; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4029826; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4154178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4177226; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4214470; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4239590; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4246162; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4259902; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4270575; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4300082; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4300574; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4322779; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4328050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4332366; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4338815; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4358363; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4373186; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4394595; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4407295; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4416410; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4426518; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4436382; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4451495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4453594; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4459654; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4471490; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4487270; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4488190; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4500966; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4506002; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4630010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4634950; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4725710; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4727358; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4747558; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4753446; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4755182; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4785218; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4832581; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4845455; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4853710; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4968022; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4973258; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4996882; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5020026; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5025186; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5025998; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5060566; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5081166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5083370; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5085686; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5098850; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5100610; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5111346; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5118094; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5119082; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5119258; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5120178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5131146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5131310; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5137182; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5139774; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5166822; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5197302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5221322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5222578; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5241386; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5243506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5257930; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5268990; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5275603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5277782; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5298158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5309022; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5316018; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5330054; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5350230; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5361318; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5362566; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5385514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5414738; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5460891; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5473581; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5483406; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5485758; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5502494; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5520863; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5607767; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5630223; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5701792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5910935; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5948493; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6226280; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6240493; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6417050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6419717; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6445925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6446619; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6508007; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6524823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6724910; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6887788; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6978048; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7120164; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7257236; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7409823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7446375; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7504426; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7544406; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7547665; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7641051; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7691183; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7711389; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7717660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7734019; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7778561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7783910; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7819993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7849853; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7863884; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7878839; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7883380; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7997243; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8024003; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8185970; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8197502; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8251443; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8256765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8326295; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8371072; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8371362; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8374166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8406500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8418202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8449183; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8452526; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8529581; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8561024; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8591082; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8605267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8630514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8641037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8656065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8738149; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8857387; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8892792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 117104; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 280574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 352366; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 642158; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 754097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 980525; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1029207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1431393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1878997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1887151; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1931495; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2036493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2278010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2589309; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2723403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3198239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3219128; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3222441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3333001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3703719; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3856135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3917194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4049691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4171547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4413711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4459575; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4535723; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4804687; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5567399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5631950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5658205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5763010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5963482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6057445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6160911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6170975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6187040; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6275251; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6323335; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6489008; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6675891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6699940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6859745; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6904627; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6909704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6994735; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7284253; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7542638; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7603209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7665867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7721695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7748709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7792069; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7856468; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8112785; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8248334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8370486; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 136826; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 137093; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 204357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 289345; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 345514; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 391686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 475482; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 495037; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 592821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 657032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 726903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 729766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 782881; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1208959; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1215247; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1297373; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1302501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1372405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1457343; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1516099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1525378; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1554423; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1565971; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1610069; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1690094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1694366; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1720149; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1880941; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1956001; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1960021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2036193; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2169969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2176154; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2182978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2239226; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2252692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2328429; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2365247; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2425730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2578653; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2665573; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2747045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2751226; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2755829; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2770749; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2800981; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2816709; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2821265; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3034929; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3182813; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3218657; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3288601; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3293430; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3355577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3403685; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3584429; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3645957; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3672770; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3715477; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3729390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3744789; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3763405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3810704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3960449; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3978758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4016625; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4400464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4498535; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4524885; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4546534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4599599; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4616270; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4671713; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4779268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4814390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4971269; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5028441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5059169; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5131822; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5340573; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5391717; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5467013; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5586045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5679550; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5724103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5804132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5834184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5835772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5973734; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6023388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6124226; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6139001; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6345917; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6431454; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6553966; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6564815; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6676852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6765012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7037374; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7078909; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7082199; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7169092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7181682; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7188651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7217826; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7248424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7276916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7300265; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7361319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7392502; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7454451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7487636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7504924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7530852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7568407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7590240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7635421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7641861; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7660147; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7738055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7751296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7764081; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7783909; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7789653; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7917617; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7937971; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7949216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7960314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8013061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8058524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8063449; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8093387; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8094757; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8100591; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8135387; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8160561; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8186241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8223058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8232762; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8234288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8256432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8258037; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8261886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8302121; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8380361; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8446562; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8508445; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8516886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8542964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8627453; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8648775; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8660693; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8715206; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8740828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8791510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8813530; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8832708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8853314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8888698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8907595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8909520; code bytes = 803033:T4d1,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004132-00000C2C-1198327270") Found reference to API "NtQuerySystemInformationW" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006608-00000C2C-1217292226") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp")34:T481,Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004132-00000C2C-1198327270") Found string "NtQuerySystemInformationW" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006608-00000C2C-1217292226") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp")35:T6f4,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004132-00000C2C-1253035122") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004132-00000C2C-1253035790") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp")36:T6b5,Found string "EnumServicesStatusExW" (Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found string "EnumServicesStatusExW" (Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found string "EnumServicesStatusExW" (Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found string "EnumServicesStatusExW" (Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found string "EnumServicesStatusExW" (Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found string "QueryServiceConfig2" (Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found string "EnumServicesStatusEx" (Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found string "EnumServicesStatus" (Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found string "QueryServiceStatusEx" (Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found string "QueryServiceConfig2 (delayed autostart flag)" (Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found string "QueryServiceConfig" (Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found string "QueryServiceConfig2W" (Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found string "QueryServiceConfigW" (Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found string "EnumServicesStatusExW" (Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found string "QueryServiceStatus" (Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found string "EnumServicesStatusExW" (Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp")37:T708,Found system information discovery API: "NtQuerySystemInformation" in "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00003128.00000000.148378.90170000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003128.00000000.148378.90170000.00000040.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00003320.00000000.147180.88C96000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003320.00000000.147180.88C96000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00004132.00000002.146867.92666000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004132.00000002.146867.92666000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00005656.00000000.147402.07E61000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005656.00000000.147402.07E61000.00000040.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00006608.00000001.144558.42472000.00000002.mdmp"38:T2ec7,"cryptojacking.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004132) "cryptojacking.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004132) "cryptojacking.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac87947c010000000000000000000051edbb57ff7f000000000000ff7f00000000000000000000a192c94db04f0000000001001a00010040ddcc57ff7f00008fecbb57ff7f0000e0ac87947c010000e0ac87947c010000000000000000000000000000ff7f0000ffffff7f44e6000000000000000000000000000000000000d8ce7b947c0100002a0000000000000069c334947c0100003100000000000000940100000000000098010000000000001100011000000000f0eb541a6800000003a3ac56ff7f0000f0eb541a6800000000000000000000002b00000000000000000000000000000020b03a947c010000b43f39947c010000e0ce7b94 (UID: 00000000-00004132) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006608) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006608) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac7755ff7f0000000000000000000051edbb57ff7f000000000000e20100000000000000000000057d1c806b6b00002a0000000000000030689a30e20100008fecbb57ff7f0000e0ac7755ff7f0000e0ac7755ff7f0000000000000000000000000000ff7f0000ffffff7fad71000000000000000000000000000000000000d8ce6b55ff7f00002a0000000000000069c32455ff7f00003100000000000000e803000000000000ec03000000000000110001100000000050d6b7272a00000003a3ac56ff7f000050d6b7272a00000000000000000000002b00000000000000000000000000000020b02a55ff7f0000b43f2955ff7f0000e0ce6b55 (UID: 00000000-00006608) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000008a30e20100000b8eb957ff7f000000008a30e201000002000000e20100003800000000000000400000000000000030038a30e2010000e8dfac282a000000010000000000000003000000000000000100000000000000170000000000000020108530e2010000000000000000000000008530e201000050291d4be2010000000000000000000051010000010000000000000000000000800000000000000004000000000000000000000000000000582d1d4be201000004000000000000003800000000000000f098ab56ff7f00003800000000000000380000000000000060e1ac282a000000c00c811fff7f000000000000 (UID: 00000000-00006608) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b04742ff7f000007000000000000000000000000000000010000000000000080ed8a30e2010000000000000000000060aa0c4be20100004c98ab56ff7f0000c0c10c4be2010000b3ce771fff7f000080ad0c4be2010000004f4742ff7f0000d0b04742ff7f00000000000000000000000000000000000080ad0c4be201000080ed8a30e2010000a0d30c4be2010000b8e1ac282a0000004c98ab56ff7f00000100000000000000b8e1ac282a000000a0d30c4be201000080ad0c4be2010000010000000000000002bc771fff7f0000b0b00c4be201000030f60a4be2010000feffffff040000007df04642ff7f000000d40c4b (UID: 00000000-00006608) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000080ed8a30e2010000000000000000000060aa0c4be20100004c98ab56ff7f000040b70c4be2010000b3ce771fff7f0000e0b00c4be2010000384f4742ff7f0000d0b04742ff7f000000000000000000000000000000000000e0b00c4be201000080ed8a30e2010000a0d30c4be2010000b0e1ac282a0000004c98ab56ff7f00000100000000000000b0e1ac282a000000a0d30c4be2010000e0b00c4be2010000010000000000000002bc771fff7f0000000000000000000030f60a4be2010000b0b00c4b04000000feffffffffffffff80ed8a30e20100007df04642ff7f000000000000 (UID: 00000000-00006608) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006044) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006044) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004804) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003200) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003516) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005392) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005592) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005408) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002212) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003320)39:T460,"cryptojacking.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "sc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")3a:T520,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp, 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp")3b:T41b,Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003200.00000000.145218.DB670000.00000004.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004804.00000000.144894.33FC0000.00000004.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005392.00000000.145866.27A20000.00000004.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005408.00000000.146526.9D040000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp, 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp, 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp")3c:Tcd8,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006608-00000C17-1217551313 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006608-00000C17-1218144073 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006608-00000C17-1218573564 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006608-00000C17-1219102885 "powershell.exe" queries volume information of "C:\share" at 00000000-00006608-00000C17-1219104366 "powershell.exe" queries volume information of "C:\share" at 00000000-00006608-00000C17-1219180155 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006608-00000C17-1219951283 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006608-00000C17-1219999821 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006608-00000C17-1220531456 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006608-00000C17-1220654966 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006608-00000C17-1220691412 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006608-00000C17-1220755366 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006608-00000C17-1220793366 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006608-00000C17-1220829016 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006608-00000C17-12208640193d:T8ae,Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "EnumServicesStatusEx" (Indicator: "EnumServicesStatus"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "EnumServicesStatus" (Indicator: "EnumServicesStatus"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "EnumDependentServices" (Indicator: "EnumDependentServices"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp")3e:T4ba,Found string "GetCommandLineA" (Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found string "GetCommandLineA" (Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found string "GetCommandLineA" (Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found string "GetCommandLineA" (Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp")3f:T6e9,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp")40:T5d41,"cryptojacking.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004132) "cryptojacking.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004132) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006608) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006608) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006044) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006044) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006044) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006044) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004804) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004804) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004804) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004804) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003200) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003200) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003200) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003200) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003516) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003516) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003516) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003516) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005392) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005392) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005392) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005392) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005592) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005592) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005592) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005592) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005408) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005408) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005408) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005408) "sc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002212) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002212) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002212) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002212) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002212) "sc.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002212) "sc.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00002212) "sc.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002212) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003320) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003320) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003320) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003320) "sc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003320) "sc.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003320) "sc.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00003320) "sc.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003320) "sc.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003320) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001268) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001268) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001268) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001268) "sc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001268) "sc.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001268) "sc.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00001268) "sc.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001268) "sc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005656) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005656) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005656) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005656) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005656) "sc.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005656) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007764) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007764) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007764) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007764) "sc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007764) "sc.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007764) "sc.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00007764) "sc.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007764) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000928) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000928) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000928) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000928) "sc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000928) "sc.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000928) "sc.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00000928) "sc.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000928) "sc.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000928) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003128) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003128) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003128) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003128) "sc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003128) "sc.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003128) "sc.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00003128) "sc.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003128) "sc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001816) "sc.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001816) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001816) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001816) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001816) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001816) "sc.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00001816) "sc.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001816) "sc.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001816)41:T706,Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp")42:T68e,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp")43:Td7f,Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp")44:T8e2,Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000928.00000000.148054.0DA61000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001816.00000000.148702.F5C56000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003128.00000000.148378.90170000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003320.00000000.147180.88C96000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004132.00000002.146867.92666000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005408.00000000.146526.7CC8B000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005656.00000000.147402.07E61000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp, 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp, 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp")45:T4ee,Found string "File Monitor - Sysinternals: www.sysinternals.com" (Indicator: "www.sysinternals.com"; Source: "00000000-00004132-00002AF8-1198326737") Found string "Process Monitor - Sysinternals: www.sysinternals.com" (Indicator: "www.sysinternals.com"; Source: "00000000-00004132-00002AF8-1198326987") Found string "Registry Monitor - Sysinternals: www.sysinternals.com" (Indicator: "www.sysinternals.com"; Source: "00000000-00004132-00002AF8-1198352141") Found string "ile Monitor - Sysinternals: www.sysinternals.com" (Indicator: "www.sysinternals.com"; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found string "egistry Monitor - Sysinternals: www.sysinternals.com" (Indicator: "www.sysinternals.com"; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp, 00000000-00004132.00000002.146867.92320000.00000004.mdmp") Found string "rocess Monitor - Sysinternals: www.sysinternals.com" (Indicator: "www.sysinternals.com"; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp, 00000000-00004132.00000002.146867.92320000.00000004.mdmp")46:T5f4,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006608.00000000.144294.308C0000.00000004.mdmp 00000000-00006608.00000001.144558.308C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006608.00000000.144294.308C0000.00000004.mdmp 00000000-00006608.00000001.144558.308C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006608.00000000.144294.4AB50000.00000004.mdmp 00000000-00006608.00000001.144558.4AB50000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006608.00000001.144558.4B1A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00006608.00000001.144558.4B1A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006608.00000001.144558.4B1A0000.00000004.mdmp "ProgramFiles(x86)=C:\Program Files (x86)\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00006608.00000001.144558.4B1A0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006608.00000001.144558.4B265000.00000004.mdmp47:T416,Process cryptojacking.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4132:304:WilStaging_02" Process cryptojacking.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4132:304:WilStaging_02" Process cryptojacking.exe created mutex with name "SM0:4132:304:WilStaging_02" Process cryptojacking.exe created mutex with name "Local\SM0:4132:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6608:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:6608:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6608:120:WilError_01" Process powershell.exe created mutex with name "SM0:6608:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6608:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6608:304:WilStaging_02"48:T1183,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]49:Ta37,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006608.00000000.144294.308C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006608.00000000.144294.308C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006608.00000000.144294.4AB50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006608.00000001.144558.308C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006608.00000001.144558.308C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006608.00000001.144558.4AB50000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006608.00000001.144558.4B1A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00006608.00000001.144558.4B1A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006608.00000001.144558.4B1A0000.00000004.mdmp "ProgramFiles(x86)=C:\Program Files (x86)\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00006608.00000001.144558.4B1A0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006608.00000001.144558.4B265000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006608.00000001.144558.EA61A000.00000002.mdmp4a:T2da7,"cryptojacking.exe" loaded module "KERNEL32" at base 7fff57370000 "cryptojacking.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fff54a30000 "cryptojacking.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fff54a30000 "cryptojacking.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fff54a30000 "cryptojacking.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fff57790000 "cryptojacking.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff54a30000 "cryptojacking.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff54a30000 "cryptojacking.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff54a30000 "cryptojacking.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff2e9e0000 "cryptojacking.exe" loaded module "USER32.DLL" at base 7fff56630000 "cryptojacking.exe" loaded module "ADVAPI32.DLL" at base 7fff56c60000 "cryptojacking.exe" loaded module "NTDLL.DLL" at base 7fff57b70000 "cryptojacking.exe" loaded module "SHELL32.DLL" at base 17c94290000 "cryptojacking.exe" loaded module "SHLWAPI.DLL" at base 7fff56820000 "cryptojacking.exe" loaded module "KERNEL32.DLL" at base 7fff57370000 "cryptojacking.exe" loaded module "PDH.DLL" at base 7fff50870000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff54a30000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff54a30000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff54a30000 "powershell.exe" loaded module "KERNEL32" at base 7fff57370000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff2e9e0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7fff56c60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fff401a0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7fff56820000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fff53f50000 "powershell.exe" loaded module "VERSION.DLL" at base 7fff4b4a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fff25ff0000 "powershell.exe" loaded module "USER32.DLL" at base 7fff56630000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fff54a30000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7fff467d0000 "powershell.exe" loaded module "NTDLL" at base 7fff57b70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fff57420000 "powershell.exe" loaded module "PSAPI.DLL" at base 7fff56a80000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7fff57370000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7fff56b40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fff249f0000 "powershell.exe" loaded module "OLE32.DLL" at base 7fff56930000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fff57420000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7fff578d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fff23d80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fff23300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7fff337c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff53300000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff549b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7fff21290000 "powershell.exe" loaded module "COMBASE.DLL" at base 7fff57420000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7fff57420000 "powershell.exe" loaded module "NTDLL.DLL" at base 7fff57b70000 "powershell.exe" loaded module "SHELL32.DLL" at base 7fff55190000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7fff54da0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7fff54da0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff547e0000 "powershell.exe" loaded module "AMSI.DLL" at base 7fff46e50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff4b4a0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fff42460000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7fff547e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\D80HNRMI.DLL" at base 7fff333b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7fff32b60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7fff329f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7fff21120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fff20870000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7fff33170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7fff1ff00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7fff1fb90000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fff54a30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fff1fa40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fff32980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7fff1f960000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7fff32930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7fff1f820000 "powershell.exe" loaded module "SECUR32.DLL" at base 7fff4b5f0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7fff53dc0000 "powershell.exe" loaded module "WLDP.DLL" at base 7fff52f20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff52540000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fff1f740000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fff57370000 "powershell.exe" loaded module "USERENV.DLL" at base 7fff53df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff56c60000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7fff57420000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7fff53a20000 "powershell.exe" loaded module "OLEAUT32" at base 7fff578d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7fff1f500000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7fff327d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7fff54a30000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7fff56aa0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7fff4acf0000 "powershell.exe" loaded module "MI.DLL" at base 7fff4c500000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7fff54a30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7fff4c470000 "powershell.exe" loaded module "GDI32.DLL" at base 7fff571d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7fff54a30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7fff48e20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7fff470d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7fff54a30000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7fff54a30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7fff47170000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7fff57370000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7fff54a30000 "cmd.exe" loaded module "KERNEL32" at base 7fff57370000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fff54a30000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fff54a30000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fff54a30000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fff57790000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff54a30000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff54a30000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff54a30000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff2e9e0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7fff57370000 "cmd.exe" loaded module "NTDLL.DLL" at base 7fff57b70000 "sc.exe" loaded module "KERNEL32" at base 7fff57370000 "sc.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fff54a30000 "sc.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fff54a30000 "sc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fff54a30000 "sc.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fff57790000 "sc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff54a30000 "sc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff54a30000 "sc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff54a30000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff2e9e0000 "sc.exe" loaded module "RPCRT4.DLL" at base 7fff56b40000 "sc.exe" loaded module "NTDLL.DLL" at base 7fff57b70000 "sc.exe" loaded module "SHLWAPI.DLL" at base 7fff56820000 "sc.exe" loaded module "PDH.DLL" at base 7fff50870000 "sc.exe" loaded module "KERNEL32.DLL" at base 7fff57370000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff467d0000 "sc.exe" loaded module "ADVAPI32.DLL" at base 7fff56c600004b:T4e4,"powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")4c:T4d9,"cryptojacking.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cryptojacking.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "sc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "sc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")4d:Tfea,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006608-00000C2E-1063910508] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006608-00000C2B-1214900306] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006608-00000C2B-1215071216] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006608-00000C2B-1215151498] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00006608-00000C2B-1215342730] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006608-00000C2B-1215391300] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006608-00000C2B-1215440818] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006608-00000C2B-1215500862] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00006608-00000C2B-1215574140] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00006608-00000C2B-1215619543] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006608-00000C2B-1215718724] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006608-00000C2B-1215928662] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006608-00000C2B-1216053924] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006608-00000C2B-1216320871] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006608-00000C2B-1216475296] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006608-00000C2B-1216819466] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006608-00000C2B-1216869431] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006608-00000C2B-1216908738] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006608-00000C2B-1216931091] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006608-00000C2B-1217132871] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006608-00000C2B-1217309075] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006608-00000C2B-1217421118] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00006608-00000C2B-1217681647] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00006608-00000C2B-1217754514] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00006608-00000C2B-1217790224]4e:T83b,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:Program ..." (UID: 00000000-00006608) Spawned process "cmd.exe" with commandline "/c wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00006044) Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00004804) Spawned process "wusa.exe" with commandline "wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00002468) Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00003200) Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00003516) Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00005392) Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00005592) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-dc 0" (UID: 00000000-00006624) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-ac 0" (UID: 00000000-00004944) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-dc 0" (UID: 00000000-00006940) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-ac 0" (UID: 00000000-00006892) Spawned process "dialer.exe" (UID: 00000000-00004300) Spawned process "sc.exe" with commandline "delete "GoogleUpdateTaskMachineQC"" (UID: 00000000-00005408) Spawned process "sc.exe" with commandline "create "GoogleUpdateTaskMachineQC" binpath= "%ALLUSERSPROFILE%\\ ..." (UID: 00000000-00002212), Spawned process "sc.exe" with commandline "start "GoogleUpdateTaskMachineQC"" (UID: 00000000-00003320), Spawned process "sc.exe" with commandline "stop eventlog" (UID: 00000000-00001268), Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00005656), Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00007764), Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00000928), Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00003128), Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00001816)4f:T83b,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:Program ..." (UID: 00000000-00006608) Spawned process "cmd.exe" with commandline "/c wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00006044) Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00004804) Spawned process "wusa.exe" with commandline "wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00002468) Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00003200) Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00003516) Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00005392) Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00005592) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-dc 0" (UID: 00000000-00006624) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-ac 0" (UID: 00000000-00004944) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-dc 0" (UID: 00000000-00006940) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-ac 0" (UID: 00000000-00006892) Spawned process "dialer.exe" (UID: 00000000-00004300) Spawned process "sc.exe" with commandline "delete "GoogleUpdateTaskMachineQC"" (UID: 00000000-00005408) Spawned process "sc.exe" with commandline "create "GoogleUpdateTaskMachineQC" binpath= "%ALLUSERSPROFILE%\\ ..." (UID: 00000000-00002212), Spawned process "sc.exe" with commandline "start "GoogleUpdateTaskMachineQC"" (UID: 00000000-00003320), Spawned process "sc.exe" with commandline "stop eventlog" (UID: 00000000-00001268), Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00005656), Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00007764), Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00000928), Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00003128), Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00001816)50:T5ad,"cryptojacking.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "cryptojacking.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "cryptojacking.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cryptojacking.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cryptojacking.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cryptojacking.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cryptojacking.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cryptojacking.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cryptojacking.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cryptojacking.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "cryptojacking.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")51:T85f,"cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "cryptojacking.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")52:T444,"cryptojacking.exe" reads file "c:\windows\system32\drivers\etc\hosts" "cryptojacking.exe" reads file "c:\cryptojacking.exe" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\b5ba37e1558ced178a99011a1d659b52\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\system.management.automation.ni.dll.aux"53:T9a2,"cryptojacking.exe" trying to access non-existent file "C:\FLTLIB.DLL" "cryptojacking.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "cryptojacking.exe" trying to access non-existent file "C:\PDH.DLL" "cryptojacking.exe" trying to access non-existent file "C:\pdh.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL"54:T9c6,"powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_HOME%" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_SYMLINK%" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1"55:Te71,Found reference to API "RAM socket #0" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp, 00000000-00004132.00000002.146867.92320000.00000004.mdmp") Found reference to API "RAM socket #1" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp, 00000000-00004132.00000002.146867.92320000.00000004.mdmp") Found reference to API "RAM socket #2" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp, 00000000-00004132.00000002.146867.92320000.00000004.mdmp") Found reference to API "RAM socket #3" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp, 00000000-00004132.00000002.146867.92320000.00000004.mdmp") Found reference to API "RAM socket #4" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp, 00000000-00004132.00000002.146867.92320000.00000004.mdmp") Found reference to API "RAM socket #5" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found reference to API "RAM socket #6" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found reference to API "RAM socket #7" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found reference to API "RAM socket #8" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found reference to API "RAM socket #9" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found reference to API "RAM socket #10" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found reference to API "RAM socket #11" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found reference to API "RAM socket #12" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found reference to API "RAM socket #13" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found reference to API "RAM socket #14" (Indicator: " socket "; Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp, 00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00006608.00000000.144294.308C0000.00000004.mdmp, 00000000-00006608.00000001.144558.308C0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp, 00000000-00006608.00000001.144558.4AB50000.00000004.mdmp")56:T1631,Heuristic match: "trp.pn" Heuristic match: "b7y.om" Pattern match: "www.avast.com0.0.0.0" Pattern match: "www.sysinternals.com" Heuristic match: "at;.cm" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "s.com" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "system.cl" Heuristic match: "6299.15.cat" Heuristic match: "ntrust.net" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.microsoft.com0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "entrust.net/cp40" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Heuristic match: "system.mp" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.co" Pattern match: "osoft.com/pki/ce" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/mi/1" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\windows-defender-management-powershell-group-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "5.cat" Heuristic match: "ne.cm" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://www.microsoft.com/d^&" Heuristic match: "*!7.3.pw" Pattern match: "osoft.com/pki/do" Heuristic match: "soft.powershell.commands.ma" Heuristic match: "hell/v1.0/en-us/microsoft.powershell.commands.management.re" Heuristic match: "hell.commands.management.re" Heuristic match: "es\microsoft.powershell.com"57:T47ab,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004132.00000000.143242.92320000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004132.00000001.145161.92320000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%yus1krdigih" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0v*" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l>" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006608.00000000.144294.4AB50000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006608.00000000.144294.4B0A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mi/1;ut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006608.00000000.144294.4B0A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" - Source: "00000000-00006608.00000001.144558.42472000.00000002.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%yus1krdigih" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006608.00000001.144558.4AB50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006608.00000001.144558.4ABC6000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l>" - Source: "00000000-00006608.00000001.144558.4ABC6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006608.00000001.144558.4ABC6000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportn" - Source: "00000000-00006608.00000001.144558.4B0C7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/d^&s/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006608.00000001.144558.4B0C7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0jggm,w" - Source: "00000000-00006608.00000001.144558.4B0C7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr