24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 97:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Jalapeno.Generic Sample f423abf74d7d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f423abf74d7d…. Malware family: Jalapeno.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 15 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132","keywords":["Malicious","Jalapeno.Generic","malware analysis","sandbox report","threat intelligence","f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132"],"about":{"@type":"SoftwareApplication","name":"f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Jalapeno.Generic","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":15,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T110e,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002104.00000000.295024.35CD0000.00000004.mdmp, 00000000-00002104.00000001.295324.35CD0000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation.ni.dll" (Source: "00000000-00002104.00000000.295024.35CD0000.00000004.mdmp, 00000000-00002104.00000001.295324.35CD0000.00000004.mdmp") Found string "n\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002104.00000000.295024.35CD0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002104.00000000.295024.35CD0000.00000004.mdmp, 00000000-00002104.00000000.295024.37E20000.00000004.mdmp, 00000000-00002104.00000001.295324.35CD0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp, 00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "System.Management.AutomationL" (Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp") Found string ""FormatHexFileAccessError", ([System.Management.Automation.ErrorCategory]::ReadError), $" (Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp, 00000000-00002104.00000001.295324.50205000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "C:\Windows\System32\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp")26:T1197,Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '" (Indicator: "add-mppreference"; File: "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%WINDIR%\cr" (Indicator: "add-mppreference"; Source: "00000000-00002912-00000C46-8835622514") Found reference string "Add-MpPreference -ExclusionPath 'C:\WINDOWS\crsvv.exe'" (Indicator: "add-mppreference"; File: "AMSI") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-42100816062") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-42252127906") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-42324961816") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Config.Msi/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-42397622070") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/crtmonitordll/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-42470303720") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-42542789598") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/inetpub/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-42615842848") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-42688725692") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-42835992682") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-42909150712") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\(x86)/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-42982206920") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-43070752988") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-43144607976") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-43217578828") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/tempdir/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-43290275998") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-43434838428") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\'" (Indicator: "add-mppreference"; Source: "00000000-00003444-00000C46-43597424234") Found reference string "Add-MpPreference -ExclusionPath 'C:/Users/'" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%WINDIR%\crsvv.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/tempdir/'" (Indicator: "add-mppreference"; Source: "00000000-00000184.00000000.295043.54710000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Config.Msi/'" (Indicator: "add-mppreference"; Source: "00000000-00000456.00000000.295019.3C790000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'" (Indicator: "add-mppreference"; Source: "00000000-00001456.00000000.295026.CFC30000.00000004.mdmp")27:T65d,Observed function "System.IO.Compression.GZipStream" in "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" Observed function "System.IO.Compression.GZipStream" in "reviewruntimeCommon.exe" Observed function "System.IO.Compression.GZipStream" in "RCX2702.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX3168.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX2318.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX3BDE.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX3851.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX3513.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX3F5A.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX2A7E.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX399B.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX1D66.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX1E13.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX2BB8.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX32D0.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX362E.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX2E1A.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX2F54.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX4084.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX3CF8.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX285A.tmp" Observed function "System.IO.Compression.GZipStream" in "RCX1FBA.tmp"28:T93a,Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "reviewruntimeCommon.exe" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX2702.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX3168.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX2318.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX3BDE.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX3851.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX3513.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX3F5A.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX2A7E.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX399B.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX1D66.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX1E13.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX2BB8.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX32D0.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX362E.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX2E1A.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX2F54.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX4084.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX3CF8.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX285A.tmp" Observed namespace "System.Reflection.Assembly" and TypeReference "GetManifestResourceStream" in "RCX1FBA.tmp"29:T7cf,file/memory contains long string with (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'" (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "on_objectModelWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpRollback.cdxml-Help.xml}Microsoft.PowerShell.Core\Export-ModuleMember -Function 'Start-MpRollback' -Alias '*'" (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp")2a:T52b,Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "reviewruntimeCommon.exe" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX2702.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX3168.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX2318.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX3BDE.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX3851.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX3513.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX3F5A.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX2A7E.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX399B.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX1D66.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX1E13.tmp" Observed namespace "Microsoft.CSharp.CSharpCodeProvider" and TypeReference ".ctor" in "RCX2BB8.tmp"2b:T1a1f,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002912-00000BC0-3545425298") Found reference to "CDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp, 00000000-00002104.00000001.295324.37D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp")2c:T595,Observed function "System.Load" in "reviewruntimeCommon.exe" Observed function "System.Reflection.Load" in "reviewruntimeCommon.exe" Observed function "System.Load" in "RCX2702.tmp" Observed function "System.Reflection.Load" in "RCX2702.tmp" Observed function "System.Load" in "RCX3168.tmp" Observed function "System.Reflection.Load" in "RCX3168.tmp" Observed function "System.Load" in "RCX2318.tmp" Observed function "System.Reflection.Load" in "RCX2318.tmp" Observed function "System.Load" in "RCX3BDE.tmp" Observed function "System.Reflection.Load" in "RCX3BDE.tmp" Observed function "System.Load" in "RCX3851.tmp" Observed function "System.Reflection.Load" in "RCX3851.tmp" Observed function "System.Load" in "RCX3513.tmp" Observed function "System.Reflection.Load" in "RCX3513.tmp" Observed function "System.Load" in "RCX3F5A.tmp" Observed function "System.Reflection.Load" in "RCX3F5A.tmp" Observed function "System.Load" in "RCX2A7E.tmp" Observed function "System.Reflection.Load" in "RCX2A7E.tmp" Observed function "System.Load" in "RCX399B.tmp" Observed function "System.Reflection.Load" in "RCX399B.tmp" Observed function "System.Load" in "RCX1D66.tmp" Observed function "System.Reflection.Load" in "RCX1D66.tmp" Observed function "System.Load" in "RCX1E13.tmp" Observed function "System.Reflection.Load" in "RCX1E13.tmp" Observed function "System.Load" in "RCX2BB8.tmp"2d:T594,Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "reviewruntimeCommon.exe" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "reviewruntimeCommon.exe" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX2702.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "RCX2702.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX3168.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "RCX3168.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX2318.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "RCX2318.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX3BDE.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "RCX3BDE.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX3851.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "RCX3851.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX3513.tmp"2e:T8f0,Observed namespace "Microsoft.VisualBasic.CompilerServices" and MemberReference "LateCall" in "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" Observed namespace "System" and MemberReference "GetMethods" in "reviewruntimeCommon.exe" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "reviewruntimeCommon.exe" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "reviewruntimeCommon.exe" Observed namespace "System" and MemberReference "GetMethod" in "reviewruntimeCommon.exe" Observed namespace "System" and MemberReference "GetMethods" in "RCX2702.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX2702.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX2702.tmp" Observed namespace "System" and MemberReference "GetMethod" in "RCX2702.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX3168.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX3168.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX3168.tmp" Observed namespace "System" and MemberReference "GetMethod" in "RCX3168.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX2318.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX2318.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX2318.tmp" Observed namespace "System" and MemberReference "GetMethod" in "RCX2318.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX3BDE.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX3BDE.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX3BDE.tmp" Observed namespace "System" and MemberReference "GetMethod" in "RCX3BDE.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX3851.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX3851.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX3851.tmp" Observed namespace "System" and MemberReference "GetMethod" in "RCX3851.tmp"2f:Tc02,f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe has big resource with name: "crsvv.exe" size: "797144" and abnormal entropy:"7.99785336147482" reviewruntimeCommon.exe has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX2702.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX3168.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX2318.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX3BDE.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX3851.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX3513.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX3F5A.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX2A7E.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX399B.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX1D66.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX1E13.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX2BB8.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX32D0.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX362E.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX2E1A.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX2F54.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX4084.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX3CF8.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX285A.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826" RCX1FBA.tmp has big resource with name: "fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq" size: "230780" and abnormal entropy:"7.999240174825826"30:Tc38,"f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" queried SystemProcessInformation at 00000000-00002912-00000C15-3543661652 [PID: 2912] "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" queried SystemProcessInformation at 00000000-00002912-00000C15-3543667972 [PID: 2912] "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" queried SystemProcessInformation at 00000000-00002912-00000C15-3543983512 [PID: 2912] "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" queried SystemProcessInformation at 00000000-00002912-00000C15-3543989932 [PID: 2912] "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" queried SystemProcessInformation at 00000000-00002912-00000C15-3546253931 [PID: 2912] "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" queried SystemProcessInformation at 00000000-00002912-00000C15-3546260579 [PID: 2912] "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" queried SystemProcessInformation at 00000000-00002912-00000C15-3563004057 [PID: 2912] "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" queried SystemProcessInformation at 00000000-00002912-00000C15-3563013948 [PID: 2912] "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" queried SystemProcessInformation at 00000000-00002912-00000C15-3564038020 [PID: 2912] "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" queried SystemProcessInformation at 00000000-00002912-00000C15-3564044330 [PID: 2912] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3547697667 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3547704815 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3550116615 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3550133016 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3551206240 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3551212865 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3551961863 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3551968596 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3552422037 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3552428655 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3554776269 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3555441911 [PID: 6584] "powershell.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-3555448958 [PID: 6584] "crsvv.exe" queried SystemProcessInformation at 00000000-00002040-00000C15-3564933341 [PID: 2040] "crsvv.exe" queried SystemProcessInformation at 00000000-00002040-00000C15-3564939603 [PID: 2040]31:Tce2,"reviewruntimeCommon.exe" renamed original file"C:\crtmonitordll\RCX1D66.tmp" to "C:\crtmonitordll\reviewruntimeCommon.exe" "reviewruntimeCommon.exe" renamed original file"C:\crtmonitordll\RCX1E13.tmp" to "C:\crtmonitordll\reviewruntimeCommon.exe" "reviewruntimeCommon.exe" renamed original file"C:\Users\Default\AppData\Local\RCX1FBA.tmp" to "%LOCALAPPDATA%\Application Data\fontdrvhost.exe" "reviewruntimeCommon.exe" renamed original file"C:\Users\Default\AppData\Local\RCX20F4.tmp" to "%LOCALAPPDATA%\Application Data\fontdrvhost.exe" "reviewruntimeCommon.exe" renamed original file"C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\RCX2318.tmp" to "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\TiWorker.exe" "reviewruntimeCommon.exe" renamed original file"C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\RCX24CE.tmp" to "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\TiWorker.exe" "reviewruntimeCommon.exe" renamed original file"C:\tempdir\node_modules\emoji-regex\es2015\RCX2702.tmp" to "C:\tempdir\node_modules\emoji-regex\es2015\UserOOBEBroker.exe" "reviewruntimeCommon.exe" renamed original file"C:\tempdir\node_modules\emoji-regex\es2015\RCX285A.tmp" to "C:\tempdir\node_modules\emoji-regex\es2015\UserOOBEBroker.exe" "reviewruntimeCommon.exe" renamed original file"C:\tempdir\node_modules\merge-descriptors\RCX2A7E.tmp" to "C:\tempdir\node_modules\merge-descriptors\msdtc.exe" "reviewruntimeCommon.exe" renamed original file"C:\tempdir\node_modules\merge-descriptors\RCX2BB8.tmp" to "C:\tempdir\node_modules\merge-descriptors\msdtc.exe" "reviewruntimeCommon.exe" renamed original file"C:\Recovery\RCX2E1A.tmp" to "C:\Recovery\MoUsoCoreWorker.exe" "reviewruntimeCommon.exe" renamed original file"C:\Recovery\RCX2F54.tmp" to "C:\Recovery\MoUsoCoreWorker.exe" "reviewruntimeCommon.exe" renamed original file"C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\RCX3168.tmp" to "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\smss.exe" "reviewruntimeCommon.exe" renamed original file"C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\RCX32D0.tmp" to "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\smss.exe" "reviewruntimeCommon.exe" renamed original file"C:\Windows\Media\Raga\RCX3513.tmp" to "%WINDIR%\Media\Raga\fontdrvhost.exe" "reviewruntimeCommon.exe" renamed original file"C:\Windows\Media\Raga\RCX362E.tmp" to "%WINDIR%\Media\Raga\fontdrvhost.exe" "reviewruntimeCommon.exe" renamed original file"C:\tempdir\node_modules\promptly\test\RCX3851.tmp" to "C:\tempdir\node_modules\promptly\test\TrustedInstaller.exe" "reviewruntimeCommon.exe" renamed original file"C:\tempdir\node_modules\promptly\test\RCX399B.tmp" to "C:\tempdir\node_modules\promptly\test\TrustedInstaller.exe" "reviewruntimeCommon.exe" renamed original file"C:\inetpub\custerr\en-US\RCX3BDE.tmp" to "C:\inetpub\custerr\en-US\lsass.exe" "reviewruntimeCommon.exe" renamed original file"C:\inetpub\custerr\en-US\RCX3CF8.tmp" to "C:\inetpub\custerr\en-US\lsass.exe" "reviewruntimeCommon.exe" renamed original file"C:\inetpub\logs\RCX3F5A.tmp" to "C:\inetpub\logs\OSPPSVC.exe" "reviewruntimeCommon.exe" renamed original file"C:\inetpub\logs\RCX4084.tmp" to "C:\inetpub\logs\OSPPSVC.exe"32:T666,Found reference to API "CryptProtectMemory failed" (Indicator: "CryptProtectMemory"; File: "00000000-00002040.00000000.292734.00F11000.00000020.mdmp") Found reference to API "CryptUnprotectMemory failed" (Indicator: "CryptUnprotectMemory"; File: "00000000-00002040.00000000.292734.00F11000.00000020.mdmp") Found reference to API "CryptProtectMemory" (Indicator: "CryptProtectMemory"; File: "00000000-00002040.00000000.292734.00F11000.00000020.mdmp") Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; File: "00000000-00002040.00000000.292734.00F11000.00000020.mdmp") Found reference to API "CryptProtectMemory failed" (Indicator: "CryptProtectMemory"; Source: "00000000-00002040.00000000.292734.00F43000.00000002.mdmp") Found reference to API "CryptUnprotectMemory failed" (Indicator: "CryptUnprotectMemory"; Source: "00000000-00002040.00000000.292734.00F43000.00000002.mdmp") Found reference to API "CryptProtectMemory" (Indicator: "CryptProtectMemory"; Source: "00000000-00002040.00000000.292734.00F43000.00000002.mdmp") Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; Source: "00000000-00002040.00000000.292734.00F43000.00000002.mdmp") Found reference to API "Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" (Indicator: "CryptProtectData"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp")33:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAKi/54AHWcDKN7MMgzW+Je4GnjudtlwpnXzX+Iejz1QKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCC2IwggTvMIID16ADAgECAhMzAAAKc/" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCuweDGBKLLkpvRIfNHqlHxBvX6u7A8kK+C53oBAy+VdKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"}34:T179a,Assembly shows XOR instruction xor ecx 49656E69h in Stream UID: 00000000-00002040-22250-11-00F2ED46 Assembly shows XOR instruction xor eax 6C65746Eh in Stream UID: 00000000-00002040-22250-11-00F2ED46 Assembly shows XOR instruction xor eax 756E6547h in Stream UID: 00000000-00002040-22250-11-00F2ED46 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-30-00F3A671 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-30-00F3A671 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00002040-22250-32-00F3A458 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00002040-22250-32-00F3A458 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-36-00F371AD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-36-00F371AD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-40-00F3A61B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-40-00F3A61B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-65-00F38140 Assembly shows XOR instruction xor esi dword ptr [00F71264h] in Stream UID: 00000000-00002040-22250-65-00F38140 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-65-00F38140 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00002040-22250-69-00F41194 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00002040-22250-69-00F41194 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00002040-22250-69-00F41194 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00002040-22250-69-00F41194 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-77-00F408C3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-77-00F408C3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-87-00F387BE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-87-00F387BE Assembly shows XOR instruction xor esi dword ptr [00F71278h] in Stream UID: 00000000-00002040-22250-87-00F387BE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-89-00F3866F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-89-00F3866F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-93-00F3B350 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-93-00F3B350 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-96-00F3AFF4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-96-00F3AFF4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-98-00F3A058 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-98-00F3A058 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-101-00F3A72C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-101-00F3A72C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-102-00F3A7B4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-102-00F3A7B4 Assembly shows XOR instruction xor eax ebx in Stream UID: 00000000-00002040-22250-112-00F37424 Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00002040-22250-112-00F37424 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-116-00F375C2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-116-00F375C2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-117-00F3A836 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-117-00F3A836 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-119-00F381F1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-119-00F381F1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-124-00F37CB9 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00002040-22250-124-00F37CB9 Assembly shows XOR instruction xor ebx edx in Stream UID: 00000000-00002040-22250-124-00F37CB9 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002040-22250-124-00F37CB9 Assembly shows XOR instruction xor esi edx in Stream UID: 00000000-00002040-22250-124-00F37CB9 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00002040-22250-124-00F37CB9 Assembly shows XOR instruction xor edx dword ptr [00F4E668h] in Stream UID: 00000000-00002040-22250-124-00F37CB9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-124-00F37CB9 Assembly shows XOR instruction xor edx dword ptr [eax] in Stream UID: 00000000-00002040-22250-126-00F3B982 Assembly shows XOR instruction xor eax dword ptr [00F4E668h] in Stream UID: 00000000-00002040-22250-126-00F3B982 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-139-00F3C099 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-139-00F3C099 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-149-00F3A6CA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-149-00F3A6CA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-183-00F3F4A8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-183-00F3F4A8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002040-22250-184-00F3F0C3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002040-22250-184-00F3F0C335:T829,Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "reviewruntimeCommon.exe" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX2702.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX3168.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX2318.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX3BDE.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX3851.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX3513.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX3F5A.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX2A7E.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX399B.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX1D66.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX1E13.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX2BB8.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX32D0.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX362E.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX2E1A.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX2F54.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX4084.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX3CF8.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX285A.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX1FBA.tmp"36:T9a3,Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "reviewruntimeCommon.exe" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX2702.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX3168.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX2318.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX3BDE.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX3851.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX3513.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX3F5A.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX2A7E.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX399B.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX1D66.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX1E13.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX2BB8.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX32D0.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX362E.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX2E1A.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX2F54.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX4084.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX3CF8.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX285A.tmp" Observed namespace "System.Security.Cryptography.CryptoStream" and TypeReference "FlushFinalBlock" in "RCX1FBA.tmp"37:Tb32,Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "reviewruntimeCommon.exe" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX2702.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX3168.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX2318.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX3BDE.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX3851.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX3513.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX3F5A.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX2A7E.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX399B.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX1D66.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX1E13.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX2BB8.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX32D0.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX362E.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX2E1A.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX2F54.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX4084.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX3CF8.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX285A.tmp" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "set_UseMachineKeyStore" in "RCX1FBA.tmp"38:T400,Found reference to API "CryptProtectMemory failed" (Indicator: "CryptProtectMemory"; File: "00000000-00002040.00000000.292734.00F11000.00000020.mdmp") Found reference to API "CryptProtectMemory" (Indicator: "CryptProtectMemory"; File: "00000000-00002040.00000000.292734.00F11000.00000020.mdmp") Found reference to API "CryptProtectMemory failed" (Indicator: "CryptProtectMemory"; Source: "00000000-00002040.00000000.292734.00F43000.00000002.mdmp") Found reference to API "CryptProtectMemory" (Indicator: "CryptProtectMemory"; Source: "00000000-00002040.00000000.292734.00F43000.00000002.mdmp") Found reference to API "Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" (Indicator: "CryptProtectData"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp")39:Tac5,Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "reviewruntimeCommon.exe" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "reviewruntimeCommon.exe" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "reviewruntimeCommon.exe" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX2702.tmp" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "RCX2702.tmp" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "RCX2702.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX3168.tmp" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "RCX3168.tmp" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "RCX3168.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX2318.tmp" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "RCX2318.tmp" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "RCX2318.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX3BDE.tmp" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "RCX3BDE.tmp" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "RCX3BDE.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX3851.tmp" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "RCX3851.tmp" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "RCX3851.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX3513.tmp" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "RCX3513.tmp" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "RCX3513.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX3F5A.tmp" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "RCX3F5A.tmp" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "RCX3F5A.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX2A7E.tmp"3a:T649,Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "reviewruntimeCommon.exe" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX2702.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX3168.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX2318.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX3BDE.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX3851.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX3513.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX3F5A.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX2A7E.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX399B.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX1D66.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX1E13.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateDecryptor" in "RCX2BB8.tmp"3b:T649,Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "reviewruntimeCommon.exe" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX2702.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX3168.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX2318.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX3BDE.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX3851.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX3513.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX3F5A.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX2A7E.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX399B.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX1D66.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX1E13.tmp" Observed namespace "System.Security.Cryptography.SymmetricAlgorithm" and TypeReference "CreateEncryptor" in "RCX2BB8.tmp"3c:T86c,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains ability to decrypt/decode data Matched sigs: YARA signature match - AES encryption Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric decryption (Dotnet)3d:T70fc,Found XOR loop in file "crsvv.exe" at offset 80956; code bytes = 30d0 Found XOR loop in file "crsvv.exe" at offset 256237; code bytes = 30d0 Found XOR loop in file "crsvv.exe" at offset 314655; code bytes = 30d0 Found XOR loop in file "crsvv.exe" at offset 315919; code bytes = 30d0 Found XOR loop in file "crsvv.exe" at offset 927401; code bytes = 30d0 Found XOR loop in file "crsvv.exe" at offset 1160625; code bytes = 30d0 Found XOR loop in file "crsvv.exe" at offset 1165242; code bytes = 30d0 Found XOR loop in file "crsvv.exe" at offset 1252285; code bytes = 30d0 Found XOR loop in file "crsvv.exe" at offset 13753; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 13871; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 55393; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 72424; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 72700; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 126518; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 126649; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 312021; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 313023; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 657502; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 1121165; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 1193054; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 1210912; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 1261988; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 1303277; code bytes = 33c1 Found XOR loop in file "crsvv.exe" at offset 52821; code bytes = 8030 Found XOR loop in file "crsvv.exe" at offset 62694; code bytes = 8030 Found XOR loop in file "crsvv.exe" at offset 117539; code bytes = 8030 Found XOR loop in file "crsvv.exe" at offset 118971; code bytes = 8030 Found XOR loop in file "crsvv.exe" at offset 158082; code bytes = 8030 Found XOR loop in file "crsvv.exe" at offset 314636; code bytes = 8030 Found XOR loop in file "crsvv.exe" at offset 315512; code bytes = 8030 Found XOR loop in file "crsvv.exe" at offset 315884; code bytes = 8030 Found XOR loop in file "crsvv.exe" at offset 658847; code bytes = 8030 Found XOR loop in file "crsvv.exe" at offset 1153908; code bytes = 8030 Found XOR loop in file "crsvv.exe" at offset 1229278; code bytes = 8030 Found XOR loop in file "crsvv.exe" at offset 1286900; code bytes = 8030 Found XOR loop in file "reviewruntimeCommon.exe" at offset 610691; code bytes = 30d0 Found XOR loop in file "reviewruntimeCommon.exe" at offset 843915; code bytes = 30d0 Found XOR loop in file "reviewruntimeCommon.exe" at offset 848532; code bytes = 30d0 Found XOR loop in file "reviewruntimeCommon.exe" at offset 935575; code bytes = 30d0 Found XOR loop in file "reviewruntimeCommon.exe" at offset 340792; code bytes = 33c1 Found XOR loop in file "reviewruntimeCommon.exe" at offset 804455; code bytes = 33c1 Found XOR loop in file "reviewruntimeCommon.exe" at offset 876344; code bytes = 33c1 Found XOR loop in file "reviewruntimeCommon.exe" at offset 894202; code bytes = 33c1 Found XOR loop in file "reviewruntimeCommon.exe" at offset 945278; code bytes = 33c1 Found XOR loop in file "reviewruntimeCommon.exe" at offset 986567; code bytes = 33c1 Found XOR loop in file "reviewruntimeCommon.exe" at offset 342137; code bytes = 8030 Found XOR loop in file "reviewruntimeCommon.exe" at offset 837198; code bytes = 8030 Found XOR loop in file "reviewruntimeCommon.exe" at offset 912568; code bytes = 8030 Found XOR loop in file "reviewruntimeCommon.exe" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX2702.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX2702.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX2702.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX2702.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX2702.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX2702.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX2702.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX2702.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX2702.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX2702.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX2702.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX2702.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX2702.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX2702.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX3168.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX3168.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX3168.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX3168.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX3168.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX3168.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX3168.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX3168.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX3168.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX3168.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX3168.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX3168.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX3168.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX3168.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX2318.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX2318.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX2318.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX2318.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX2318.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX2318.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX2318.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX2318.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX2318.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX2318.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX2318.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX2318.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX2318.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX2318.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX3BDE.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX3BDE.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX3BDE.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX3BDE.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX3BDE.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX3BDE.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX3BDE.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX3BDE.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX3BDE.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX3BDE.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX3BDE.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX3BDE.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX3BDE.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX3BDE.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX3851.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX3851.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX3851.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX3851.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX3851.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX3851.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX3851.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX3851.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX3851.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX3851.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX3851.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX3851.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX3851.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX3851.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX3513.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX3513.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX3513.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX3513.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX3513.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX3513.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX3513.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX3513.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX3513.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX3513.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX3513.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX3513.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX3513.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX3513.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX3F5A.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX3F5A.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX3F5A.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX3F5A.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX3F5A.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX3F5A.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX3F5A.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX3F5A.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX3F5A.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX3F5A.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX3F5A.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX3F5A.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX3F5A.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX3F5A.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX2A7E.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX2A7E.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX2A7E.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX2A7E.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX2A7E.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX2A7E.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX2A7E.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX2A7E.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX2A7E.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX2A7E.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX2A7E.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX2A7E.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX2A7E.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX2A7E.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX399B.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX399B.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX399B.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX399B.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX399B.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX399B.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX399B.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX399B.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX399B.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX399B.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX399B.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX399B.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX399B.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX399B.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX1D66.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX1D66.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX1D66.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX1D66.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX1D66.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX1D66.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX1D66.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX1D66.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX1D66.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX1D66.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX1D66.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX1D66.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX1D66.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX1D66.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX1E13.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX1E13.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX1E13.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX1E13.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX1E13.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX1E13.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX1E13.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX1E13.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX1E13.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX1E13.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX1E13.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX1E13.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX1E13.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX1E13.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX2BB8.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX2BB8.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX2BB8.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX2BB8.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX2BB8.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX2BB8.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX2BB8.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX2BB8.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX2BB8.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX2BB8.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX2BB8.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX2BB8.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX2BB8.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX2BB8.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX32D0.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX32D0.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX32D0.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX32D0.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX32D0.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX32D0.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX32D0.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX32D0.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX32D0.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX32D0.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX32D0.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX32D0.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX32D0.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX32D0.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX362E.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX362E.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX362E.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX362E.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX362E.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX362E.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX362E.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX362E.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX362E.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX362E.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX362E.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX362E.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX362E.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX362E.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX2E1A.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX2E1A.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX2E1A.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX2E1A.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX2E1A.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX2E1A.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX2E1A.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX2E1A.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX2E1A.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX2E1A.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX2E1A.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX2E1A.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX2E1A.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX2E1A.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX2F54.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX2F54.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX2F54.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX2F54.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX2F54.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX2F54.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX2F54.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX2F54.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX2F54.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX2F54.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX2F54.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX2F54.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX2F54.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX2F54.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX4084.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX4084.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX4084.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX4084.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX4084.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX4084.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX4084.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX4084.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX4084.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX4084.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX4084.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX4084.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX4084.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX4084.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX3CF8.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX3CF8.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX3CF8.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX3CF8.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX3CF8.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX3CF8.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX3CF8.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX3CF8.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX3CF8.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX3CF8.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX3CF8.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX3CF8.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX3CF8.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX3CF8.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX285A.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX285A.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX285A.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX285A.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX285A.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX285A.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX285A.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX285A.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX285A.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX285A.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX285A.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX285A.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX285A.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX285A.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX1FBA.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX1FBA.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX1FBA.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX1FBA.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX1FBA.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX1FBA.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX1FBA.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX1FBA.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX1FBA.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX1FBA.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX1FBA.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX1FBA.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX1FBA.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX1FBA.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX24CE.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX24CE.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX24CE.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX24CE.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX24CE.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX24CE.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX24CE.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX24CE.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX24CE.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX24CE.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX24CE.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX24CE.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX24CE.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX24CE.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "RCX20F4.tmp" at offset 610691; code bytes = 30d0 Found XOR loop in file "RCX20F4.tmp" at offset 843915; code bytes = 30d0 Found XOR loop in file "RCX20F4.tmp" at offset 848532; code bytes = 30d0 Found XOR loop in file "RCX20F4.tmp" at offset 935575; code bytes = 30d0 Found XOR loop in file "RCX20F4.tmp" at offset 340792; code bytes = 33c1 Found XOR loop in file "RCX20F4.tmp" at offset 804455; code bytes = 33c1 Found XOR loop in file "RCX20F4.tmp" at offset 876344; code bytes = 33c1 Found XOR loop in file "RCX20F4.tmp" at offset 894202; code bytes = 33c1 Found XOR loop in file "RCX20F4.tmp" at offset 945278; code bytes = 33c1 Found XOR loop in file "RCX20F4.tmp" at offset 986567; code bytes = 33c1 Found XOR loop in file "RCX20F4.tmp" at offset 342137; code bytes = 8030 Found XOR loop in file "RCX20F4.tmp" at offset 837198; code bytes = 8030 Found XOR loop in file "RCX20F4.tmp" at offset 912568; code bytes = 8030 Found XOR loop in file "RCX20F4.tmp" at offset 970190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 13774; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 139431; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 186409; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 187355; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 187889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 337115; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 476040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 477768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 619381; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 623998; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 711066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 792469; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 184273; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 204410; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 210080; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 210898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 288515; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 291768; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 422315; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 424488; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 579906; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 651820; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 669683; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 720774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 762073; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 33849; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 137196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 269367; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 286451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 316822; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 612659; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 688054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 745691; code bytes = 80303e:T63b,Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00006584-00000C2B-3551721760") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00006584-00000C2B-3551721796") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002040-00000C2B-3566462389") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002040-00000C2B-3566465646") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002040.00000000.292734.00F43000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002040.00000000.292734.00F43000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002040.00000000.292734.00F43000.00000002.mdmp") Found reference to API "ystem.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp")3f:T203e,"f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000d8e937000000000018000000000000000fc784aeecd100002f876d00000000001a0000000000000070e937000000000070556c000000000000826d00000000001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000009adaff7f00004adf6bf6e8af0000e0469adaff7f000030876d000000000098069bdaff7f0000e08e6d0000000000000045daff7f00000000000000000000e0469adaff7f00000300000000000000f3859ddcff7f00006e479adaff7f000027669ddcff7f0000b0e93700 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938e9d9ff7f000080000000000000000000000000000000c0017800000000001033a0dcff7f000000000000000000000000c2dbff7f000090d43700000000001041e6d9ff7f0000605776000000000050d4370000000000000000000000000000000000000000000100000000000000b840e6d9ff7f0000060000000000000001000000000000000000c2dbff7f00003b4dfad9ff7f0000000000000000000008d93700000000000000000000000000d02ad4dbff7f000010b33adcff7f0000e8f8e5d9ff7f000010b33adcff7f0000d02ad4dbff7f00000d000000ff7f00000d00000000000000a0f62adcff7f0000f587cfdbff7f0000d02ad4db (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000008070780000000000ca85780000000000e084780000000000789d370000000000689d370000000000689d370001000000789f370000000000487389dbff7f000000000000000000008070780000000000ef5ef6d7ff7f0000801d47d8ff7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000086857800000000009c857800000000008685780000000000ca8578000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000086857800 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000006063780000000000dc86780000000000f085780000000000789d370000000000689d370000000000689d370001000000789f370000000000487389dbff7f000000000000000000006063780000000000ef5ef6d7ff7f0000801d47d8ff7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000009686780000000000ae867800000000009686780000000000dc8678000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000096867800 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000f0337a000000000068067700000000008005770000000000789d370000000000689d370000000000689d370001000000789f370000000000487389dbff7f00000000000000000000f0337a0000000000ef5ef6d7ff7f0000801d47d8ff7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000026067700000000003a067700000000002606770000000000680677000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000026067700 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000070277a0000000000ac94780000000000c093780000000000789d370000000000689d370000000000689d370001000000789f370000000000487389dbff7f0000000000000000000070277a0000000000ef5ef6d7ff7f0000801d47d8ff7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000066947800000000007e947800000000006694780000000000ac9478000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066947800 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000d02b7a0000000000da86780000000000f085780000000000789d370000000000689d370000000000689d370001000000789f370000000000487389dbff7f00000000000000000000d02b7a0000000000ef5ef6d7ff7f0000801d47d8ff7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000009686780000000000ac867800000000009686780000000000da8678000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000096867800 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000080267a0000000000dc86780000000000f085780000000000789d370000000000689d370000000000689d370001000000789f370000000000487389dbff7f0000000000000000000080267a0000000000ef5ef6d7ff7f0000801d47d8ff7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000009686780000000000ae867800000000009686780000000000dc8678000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000096867800 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000c0317a00000000000c8a7800000000002089780000000000789d370000000000689d370000000000689d370001000000789f370000000000487389dbff7f00000000000000000000c0317a0000000000ef5ef6d7ff7f0000801d47d8ff7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000c689780000000000de89780000000000c6897800000000000c8a780000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c6897800 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002912)40:T1856,"f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f023000002000000000000009817fcd9ff7f00004843a61b0000000001009dbdff7f000000009dbdff7f00000400000000000000001000000000000004000000000000000000000000000000873b9dbdff7f00000000ae1b00000000002000000000000000000000000000000000000000000000b098d3bdff7f00001b429dbdff7f00002089d3bd (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000002089d3bdff7f000000000000000000002f9484aeecd100009c0000000600000002000000f023000002000000000000009817fcd9ff7f00004843a61b0000000001009dbdff7f000000009dbdff7f00000400000000000000001000000000000004000000000000000000000000000000873b9dbdff7f00000000ae1b (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f023000002000000000000009817fcd9ff7f00004843a61b0000000001009dbdff7f000000009dbdff7f00000400000000000000001000000000000004000000000000000000000000000000873b9dbdff7f00000000ae1b000000000020000000000000deef9301185ddc0100000000000000002089d3bdff7f000087569dbdff7f00002089d3bd (UID: 00000000-00002912) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000010cac73d1e020000c0fb52b2ff7f00000001000000000000b8fb52b2ff7f0000000000000000000080cb62dcff7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a52b2ff7f00000000000000000000b8fb52b2ff7f000000000000 (UID: 00000000-00006584) "crsvv.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000007fa020000fa02000000000000000000000000105254030000000000000000a8da2f030200000010000000c001fa0200000000020000000000fa020100000008000000000054030c0afa0200000000080afa0278e12f03febaf476080000000000000008000000f6bacc99bce32f03da91a772000054030800000001000000 (UID: 00000000-00002040) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000180000005900f6760000000050f3cf000000000018fbcf003017bb72432da474feffffff44facf00be46b97206000000d04de40000000000ce46b972632da47400000000000000000000000000000000000000000000000000000000000000000000e400 (UID: 00000000-00008952) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000000000000000000002000000000000000000000000000000c8efcf00e21bceec00f0cf00e5376f75c0020000fffffffffcefcf000000000000000000f0efcf00f8efcf000100000000000000020000000000000070f0cf000000000000000000001000000000040524f0cf005180e500c0020000040000000000000000000000 (UID: 00000000-00008952) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000f9c8710000000011000000f0f1c8718000000000000000000035030c0000000000000000000000b0dccf00febaf4760000000000000000800000008032c871d0dccf002d8348750000350300000000800000008032c87102000000ec13c871e8dccf008b32c87180000000b437c87101000000a8e4c87114ddcf004134c871 (UID: 00000000-00008952) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000934f759ccacf002df8c4710800000011f8c4717ce1ce68804cc4711020c471020000004000c571d06b3503c86b350368cacf001020c4713ccbcf00d0f5c471b0b4c719feffffffa8cacf0042f8c4714000c571c0cacf00944cc4714000c571cf7b4a7501000000a4bbc671eccacf0041f2c4710820c4711420c47100000000 (UID: 00000000-00008952) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000cf63bf71c320211b9035bf712818bf7102000000a07fbf71046b3503e86a350358d6cf000018c1712cd7cf004064bf71e7092e6afeffffff98d6cf000064bf71a07fbf71b0d6cf009f35bf71a07fbf71cf7b4a7501000000d015c171dcd6cf00a15dbf710018bf712c18bf710000000019de7a750000000001000000 (UID: 00000000-00008952) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000018bf710200000011000000046b35038000000000000000000035032cd7cf004064bf71e7092e6aa0d6cf00febaf476000000000000000080000000a042c271c0d6cf002d834875000035030000000080000000a042c271020000004418c271d8d6cf00ab42c27180000000d447c27101000000f015c37104d7cf006144c271 (UID: 00000000-00008952) "reviewruntimeCommon.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000054dcb41b00000000000000000000000044dcb41b00000000b836e70200000000000000000000000024f0f6b0ff7f00000000000000000000100000000000000000000000000000000000e7020000000010000000000000006f5b86b1ff7f000000000000 (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000c4dbb41b000000000000000000000000b4dbb41b00000000b836e70200000000000000000000000024f0f6b0ff7f000000000000000000001000000000000000000000000000000000009edcff7f000010000000000000006f5b86b1ff7f000000000000 (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000054dcb41b00000000000000000000000044dcb41b00000000b836e70200000000000000000000000024f0f6b0ff7f000000000000000000001000000000000000000000000000000000009edcff7f000010000000000000006f5b86b1ff7f000000000000 (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000054dcb41b00000000000000000000000044dcb41b00000000b836e70200000000000000000000000024f0f6b0ff7f000000000000000000001000000000000000000000000000000000009fdcff7f000010000000000000006f5b86b1ff7f000000000000 (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000c4dbb41b000000000000000000000000b4dbb41b00000000b836e70200000000000000000000000024f0f6b0ff7f000000000000000000001000000000000000000000000000000000009fdcff7f000010000000000000006f5b86b1ff7f000000000000 (UID: 00000000-00003444)41:T434,Observed namespace "System.Management.ManagementObjectSearcher" in "reviewruntimeCommon.exe" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX2702.tmp" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX3168.tmp" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX2318.tmp" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX3BDE.tmp" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX3851.tmp" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX3513.tmp" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX3F5A.tmp" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX2A7E.tmp" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX399B.tmp" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX1D66.tmp" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX1E13.tmp" Observed namespace "System.Management.ManagementObjectSearcher" in "RCX2BB8.tmp"42:T5a8,Observed function "get_SystemDirectory" in "reviewruntimeCommon.exe" Observed function "get_OSVersion" in "reviewruntimeCommon.exe" Observed function "get_Is64BitOperatingSystem" in "reviewruntimeCommon.exe" Observed function "get_MachineName" in "reviewruntimeCommon.exe" Observed function "get_UserName" in "reviewruntimeCommon.exe" Observed function "get_Version" in "reviewruntimeCommon.exe" Observed function "get_SystemDirectory" in "RCX2702.tmp" Observed function "get_OSVersion" in "RCX2702.tmp" Observed function "get_Is64BitOperatingSystem" in "RCX2702.tmp" Observed function "get_MachineName" in "RCX2702.tmp" Observed function "get_UserName" in "RCX2702.tmp" Observed function "get_Version" in "RCX2702.tmp" Observed function "get_SystemDirectory" in "RCX3168.tmp" Observed function "get_OSVersion" in "RCX3168.tmp" Observed function "get_Is64BitOperatingSystem" in "RCX3168.tmp" Observed function "get_MachineName" in "RCX3168.tmp" Observed function "get_UserName" in "RCX3168.tmp" Observed function "get_Version" in "RCX3168.tmp" Observed function "get_SystemDirectory" in "RCX2318.tmp" Observed function "get_OSVersion" in "RCX2318.tmp" Observed function "get_Is64BitOperatingSystem" in "RCX2318.tmp" Observed function "get_MachineName" in "RCX2318.tmp" Observed function "get_UserName" in "RCX2318.tmp" Observed function "get_Version" in "RCX2318.tmp" Observed function "get_SystemDirectory" in "RCX3BDE.tmp"43:T8e6,Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "reviewruntimeCommon.exe" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX2702.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX3168.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX2318.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX3BDE.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX3851.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX3513.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX3F5A.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX2A7E.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX399B.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX1D66.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX1E13.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX2BB8.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX32D0.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX362E.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX2E1A.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX2F54.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX4084.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX3CF8.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX285A.tmp" Observed Namespace "System.Diagnostics.Process" and MemberReference "get_MainWindowTitle" in "RCX1FBA.tmp"44:T832,"f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "crsvv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "crsvv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS")45:Ta0f,Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "reviewruntimeCommon.exe" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX2702.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX3168.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX2318.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX3BDE.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX3851.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX3513.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX3F5A.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX2A7E.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX399B.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX1D66.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX1E13.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX2BB8.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX32D0.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX362E.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX2E1A.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX2F54.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX4084.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX3CF8.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX285A.tmp" Observed Namespace "System.Security.Principal.WindowsIdentity" and MemberReference "GetCurrent" in "RCX1FBA.tmp"46:T6ee,"crsvv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "crsvv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "crsvv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "crsvv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\FILEASSOCIATIONS"; Key: ".VBE"; Value: "") "crsvv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "crsvv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "") "crsvv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "crsvv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\FILEASSOCIATIONS"; Key: ".VBE"; Value: "") "crsvv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: ""; Value: "") "crsvv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: "HIDDEN"; Value: "") "crsvv.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "crsvv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\FILEASSOCIATIONS"; Key: ".VBE"; Value: "")47:T5da,"f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" queries volume information of "C:\f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" at 00000000-00002912-00000C17-3545429304 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00006584-00000C17-3553214831 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006584-00000C17-3553767698 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006584-00000C17-3554013008 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006584-00000C17-3555265146 "powershell.exe" queries volume information of "C:\" at 00000000-00006584-00000C17-3555753586 "powershell.exe" queries volume information of "C:\share" at 00000000-00006584-00000C17-3555755236 "powershell.exe" queries volume information of "C:\share" at 00000000-00006584-00000C17-3555864694 "reviewruntimeCommon.exe" queries volume information of "C:\crtmonitordll\reviewruntimeCommon.exe" at 00000000-00003444-00000C17-358440020648:T457,"f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CRSVV.EXE") "crsvv.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WSCRIPT.EXE") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\7MBRRXDHLWJJS0ZOM14GV.BAT") "reviewruntimeCommon.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\REVIEWRUNTIMECOMMON.EXE")49:T7ff,Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "reviewruntimeCommon.exe" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX2702.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX3168.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX2318.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX3BDE.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX3851.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX3513.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX3F5A.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX2A7E.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX399B.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX1D66.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX1E13.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX2BB8.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX32D0.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX362E.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX2E1A.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX2F54.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX4084.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX3CF8.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX285A.tmp" Observed function "System.Diagnostics.ProcessStartInfo.UseShellExecute" in "RCX1FBA.tmp"4a:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")4b:T5ca,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")4c:T7f3,"reviewruntimeCommon.exe" called "CopyFileW" to copy C:\crtmonitordll\reviewruntimeCommon.exe to new location %LOCALAPPDATA%\Application Data\fontdrvhost.exe (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CopyFileW" to copy C:\crtmonitordll\reviewruntimeCommon.exe to new location C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\TiWorker.exe (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CopyFileW" to copy C:\crtmonitordll\reviewruntimeCommon.exe to new location C:\tempdir\node_modules\emoji-regex\es2015\UserOOBEBroker.exe (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CopyFileW" to copy C:\crtmonitordll\reviewruntimeCommon.exe to new location C:\tempdir\node_modules\merge-descriptors\msdtc.exe (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CopyFileW" to copy C:\crtmonitordll\reviewruntimeCommon.exe to new location C:\Recovery\MoUsoCoreWorker.exe (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CopyFileW" to copy C:\crtmonitordll\reviewruntimeCommon.exe to new location C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\smss.exe (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CopyFileW" to copy C:\crtmonitordll\reviewruntimeCommon.exe to new location %WINDIR%\Media\Raga\fontdrvhost.exe (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CopyFileW" to copy C:\crtmonitordll\reviewruntimeCommon.exe to new location C:\crtmonitordll\reviewruntimeCommon.exe (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CopyFileW" to copy C:\crtmonitordll\reviewruntimeCommon.exe to new location C:\tempdir\node_modules\promptly\test\TrustedInstaller.exe (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CopyFileW" to copy C:\crtmonitordll\reviewruntimeCommon.exe to new location C:\inetpub\custerr\en-US\lsass.exe (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CopyFileW" to copy C:\crtmonitordll\reviewruntimeCommon.exe to new location C:\inetpub\logs\OSPPSVC.exe (UID: 00000000-00003444)4d:Tfe3,"f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%WINDIR%\cr" - (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /Create /F /TN "crsvv" /SC ONLOGON /TR "%WINDIR%\crsvv.exe" /RL HIGHEST" - (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "CreateProcessW" with parameter ""%WINDIR%\crsvv.exe"" - (UID: 00000000-00002912) "crsvv.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WScript.exe" "C:\crtmonitordll\GU7v70W0uZRr0DGxqpPx.vbe"" - (UID: 00000000-00002040) "WScript.exe" called "CreateProcessW" with parameter ""C:\crtmonitordll\7mBRRXdHLWjJs0zOm14gv.bat"" - (UID: 00000000-00008952) "cmd.exe" called "CreateProcessW" with parameter ""C:\crtmonitordll\reviewruntimeCommon.exe"" - (UID: 00000000-00007688) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Config.Msi/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/crtmonitordll/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/inetpub/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\(x86)/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/tempdir/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\'" - (UID: 00000000-00003444) "reviewruntimeCommon.exe" called "CreateProcessW" with parameter ""C:\crtmonitordll\reviewruntimeCommon.exe"" - (UID: 00000000-00003444)4e:Tdc5e,"f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\46c2f46666e40896049aed7e4ed25573\Microsoft.VisualBasic.ni.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (UID: 00000000-00002912) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\199f66bc1a6fe937deb9e320cbcaacd7\Microsoft.Management.Infrastr (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006584) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006584) "crsvv.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002040) "crsvv.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002040) "crsvv.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002040) "crsvv.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002040) "crsvv.exe" called "LoadLibrary" with a parameter mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp") Found URL "http://www.microsoft.com0redmond1microsoft" - Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=225750" - Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=113316')]param(" - Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=160712" - Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00002104.00000000.295024.4FF30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002104.00000000.295024.4FF30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002104.00000000.295024.4FF30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002104.00000000.295024.4FF30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002104.00000001.295324.35CD0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002104.00000001.295324.37D10000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0j1" - Source: "00000000-00002104.00000001.295324.37D10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002104.00000001.295324.37D10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm6n5" - Source: "00000000-00002104.00000001.295324.37D10000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002104.00000001.295324.37D10000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002104.00000001.295324.37D10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002104.00000001.295324.37D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002104.00000001.295324.37D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002104.00000001.295324.37D90000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportec24calrpc:[impservice77bdaf73-b396-481f-9042-ad358843ec24]nternaldefinitionupdateserver" - Source: "00000000-00002104.00000001.295324.50205000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0g4zx" - Source: "00000000-00002104.00000001.295324.50205000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002104.00000001.295324.50205000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0eptl(*vm:wf" - Source: "00000000-00002104.00000001.295324.50205000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&u" - Source: "00000000-00002104.00000001.295324.50205000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0au]8&l*" - Source: "00000000-00002104.00000001.295324.50205000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@j1gsp" - Source: "00000000-00002104.00000001.295324.50205000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0@mt-bivop?u3gx%nhlj(ofv!@dqzs>snhttp://www.microsoft.com/pki/certs/mi_ut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002104.00000001.295324.50205000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/vmg'k5a" - Source: "00000000-00002104.00000001.295324.50205000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0\r]6x/6" - Source: "00000000-00002104.00000001.295324.50205000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00002912.00000001.292423.02B50000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportrpc" - Source: "00000000-00003444.00000000.293883.009B0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\crtmonitordll\reviewruntimecommon.exe.configc:\crtmonitordll\reviewruntimecommon.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\ftra9nz\appdata\roaming\microsoft\clr" - Source: "00000000-00003444.00000000.293883.02D10000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003444.00000000.293883.02D10000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportrpc" - Source: "00000000-00003444.00000000.293883.1BC50000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportrpc" - Source: "00000000-00003444.00000001.294808.1BC50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006584.00000001.292245.3DC30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00006584.00000001.292245.3DC30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006584.00000001.292245.3DC30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00006584.00000001.292245.3DC30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006584.00000001.292245.3DC8F000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lgz;" - Source: "00000000-00006584.00000001.292245.3DC8F000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lquuu" - Source: "00000000-00006584.00000001.292245.3DC8F000.00000004.mdmp") Found URL "https://go.mic" - Source: "00000000-00006584.00000001.292245.3DC8F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00006584.00000001.292245.3DC8F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006584.00000001.292245.3DC8F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00006584.00000001.292245.3DC8F000.00000004.mdmp") Found URL "http://www.microsoft.comre=n-l," - Source: "00000000-00006584.00000001.292245.3DD01000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006584.00000001.292245.3DE30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0@mt-bivop?u3gx%nhlj(ofv!@dqzs>snhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/doccallsite.targetcallsite.targetlambda_methodn45" - Source: "00000000-00006584.00000001.292245.3DE8B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/vmg'k5a" - Source: "00000000-00006584.00000001.292245.3DE8B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0fg:smxsu$was.,k" - Source: "00000000-00006584.00000001.292245.3DE8B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0\r]6x/6" - Source: "00000000-00006584.00000001.292245.3DE8B000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00006584.00000001.292245.CBFC3000.00000002.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007520.00000000.295112.13370000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=225750" - Source: "00000000-00007764.00000000.295048.37B50000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=113316')]param(" - Source: "00000000-00007764.00000000.295048.37B50000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=160712" - Source: "00000000-00007764.00000000.295048.37B50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007764.00000000.295048.4FB50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris=39123123p00083100p9605282201013000pinternet1verisign," - Source: "00000000-00007764.00000000.295048.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007764.00000000.295048.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00007764.00000000.295048.4FB50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007764.00000000.295048.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007764.00000000.295048.4FB50000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007764.00000000.295048.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00007764.00000000.295048.4FB50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0jw.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007764.00000000.295048.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007764.00000000.295048.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00007764.00000000.295048.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00007764.00000000.295048.4FD20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007764.00000000.295048.4FD20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00007764.00000000.295048.4FD20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007764.00000000.295048.4FD20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007764.00000001.295328.4FB50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris=39123123p00083100p9605282201013000pinternet1verisign," - Source: "00000000-00007764.00000001.295328.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007764.00000001.295328.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00007764.00000001.295328.4FB50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007764.00000001.295328.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007764.00000001.295328.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00007764.00000001.295328.4FB50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0jw.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007764.00000001.295328.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007764.00000001.295328.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00007764.00000001.295328.4FB50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl" - Source: "00000000-00007764.00000001.295328.4FC1C000.00000004.mdmp") Found URL "http://'z0i04;" - Source: "00000000-00007764.00000001.295328.4FD20000.00000004.mdmp") Found URL "http://www.microsoft.comcrl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007764.00000001.295328.4FD20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0\r]6x/6" - Source: "00000000-00007764.00000001.295328.4FD20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&washington1redmond1microsoft" - Source: "00000000-00007764.00000001.295328.4FD20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@nagr[d" - Source: "00000000-00007764.00000001.295328.4FD20000.00000004.mdmp") Found URL "http://www.microsoft.com0lpxx" - Source: "00000000-00007764.00000001.295328.4FD20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007764.00000001.295328.4FD20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007764.00000001.295328.4FD20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/doc3xuyw" - Source: "00000000-00007764.00000001.295328.4FE76000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport1f-90-a<358calrpc:[impcpyacltr1d8d3448-2a8d-409f-841d-2db9e0220897]indows" - Source: "00000000-00007764.00000001.295328.4FE96000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0g4zx" - Source: "00000000-00007764.00000001.295328.4FE96000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007764.00000001.295328.4FE96000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0eptl(*vm:wf" - Source: "00000000-00007764.00000001.295328.4FE96000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&c5n6c5n6c5n6c5n6c5n6c5n6c5n6c5n6u=;i" - Source: "00000000-00007764.00000001.295328.4FE96000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0au]8&l*" - Source: "00000000-00007764.00000001.295328.4FE96000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0@mt-bivop?u3gx%nhlj(ofv!@dqzs>snhttp://www.microsoft.com/pki/certs/miut_2010-06-23.crt0>ngdxfg:smas.,k" - Source: "00000000-00007764.00000001.295328.4FE96000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0sjv" - Source: "00000000-00007764.00000001.295328.4FE96000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/vmg'k5a" - Source: "00000000-00007764.00000001.295328.4FE96000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0g4zx0ga1ter03vdazlpxx" - Source: "00000000-00007764.00000001.295328.4FE96000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0\r]6x/6" - Source: "00000000-00007764.00000001.295328.4FE96000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows.system.internal.launch.launcherqueryinfo.2781761e-28e0-4109-99fe-b9d127c57afe" - Source: "00000000-00008952.00000001.293511.02EDA000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00008952.00000001.293511.71CA1000.00000020.mdmp")77:T690,YARA signature to detect medium entropy file file "RCX399B.tmp" YARA signature to detect medium entropy file file "RCX2318.tmp" YARA signature to detect medium entropy file file "reviewruntimeCommon.exe" YARA signature to detect medium entropy file file "RCX2F54.tmp" YARA signature to detect medium entropy file process "00000000-00002040" YARA signature to detect medium entropy file file "RCX32D0.tmp" YARA signature to detect medium entropy file file "RCX20F4.tmp" YARA signature to detect medium entropy file file "RCX24CE.tmp" YARA signature to detect medium entropy file process "00000000-00008364" YARA signature to detect medium entropy file file "RCX3851.tmp" YARA signature to detect medium entropy file file "RCX285A.tmp" YARA signature to detect medium entropy file file "RCX1FBA.tmp" YARA signature to detect medium entropy file file "RCX3168.tmp" YARA signature to detect medium entropy file file "RCX3BDE.tmp" YARA signature to detect medium entropy file file "RCX1D66.tmp" YARA signature to detect medium entropy file file "RCX2702.tmp" YARA signature to detect medium entropy file file "RCX4084.tmp" YARA signature to detect medium entropy file process "00000000-00002104" YARA signature to detect medium entropy file file "RCX2A7E.tmp" YARA signature to detect medium entropy file file "RCX3513.tmp" YARA signature to detect medium entropy file process "00000000-00008952" YARA signature to detect medium entropy file file "RCX2E1A.tmp" YARA signature to detect medium entropy file process "00000000-00002912" YARA signature to detect medium entropy file file "RCX362E.tmp" YARA signature to detect medium entropy file file "RCX3F5A.tmp"78:T699,YARA signature matched on R0R instruction used in file "RCX399B.tmp" YARA signature matched on R0R instruction used in file "RCX2318.tmp" YARA signature matched on R0R instruction used in file "reviewruntimeCommon.exe" YARA signature matched on R0R instruction used in file "RCX2F54.tmp" YARA signature matched on R0R instruction used in file "RCX32D0.tmp" YARA signature matched on R0R instruction used in file "RCX20F4.tmp" YARA signature matched on R0R instruction used in file "RCX24CE.tmp" YARA signature matched on R0R instruction used in file "RCX3851.tmp" YARA signature matched on R0R instruction used in file "RCX285A.tmp" YARA signature matched on R0R instruction used in file "RCX1FBA.tmp" YARA signature matched on R0R instruction used in file "RCX3168.tmp" YARA signature matched on R0R instruction used in file "RCX3BDE.tmp" YARA signature matched on R0R instruction used in file "RCX1D66.tmp" YARA signature matched on R0R instruction used in file "RCX2702.tmp" YARA signature matched on R0R instruction used in file "RCX4084.tmp" YARA signature matched on R0R instruction used in file "sample.bin" YARA signature matched on R0R instruction used in file "RCX2A7E.tmp" YARA signature matched on R0R instruction used in file "RCX3513.tmp" YARA signature matched on R0R instruction used in file "RCX2E1A.tmp" YARA signature matched on R0R instruction used in file "RCX362E.tmp" YARA signature matched on R0R instruction used in file "RCX3F5A.tmp" YARA signature matched on R0R instruction used in file "RCX2BB8.tmp" YARA signature matched on R0R instruction used in file "RCX1E13.tmp" YARA signature matched on R0R instruction used in file "RCX3CF8.tmp"79:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp")7a:T56d,Found string "F+ncalrpc:[OLEC6396FD49749B2AD69B8FB5040E0]" (Indicator: "ncalrpc"; Source: "00000000-00002040.00000000.292734.03578000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002040.00000000.292734.03578000.00000004.mdmp") Found string "+ncalrpc:[OLEB38ADBC31EBB2F1A5AF8539C13AF]" (Indicator: "ncalrpc"; Source: "00000000-00002040.00000000.292734.0359E000.00000004.mdmp") Found string "+ncalrpc:[OLEC6396FD49749B2AD69B8FB5040E0]" (Indicator: "ncalrpc"; Source: "00000000-00002040.00000000.292734.0359E000.00000004.mdmp, 00000000-00002040.00000000.292734.0360E000.00000004.mdmp") Found string "B+ncalrpc:[OLE0416F4B6FD5308CF2051880C67C0]" (Indicator: "ncalrpc"; Source: "00000000-00002040.00000000.292734.0359E000.00000004.mdmp") Found string "+ncalrpc:[OLE0416F4B6FD5308CF2051880C67C0]" (Indicator: "ncalrpc"; Source: "00000000-00002040.00000000.292734.0359E000.00000004.mdmp") Found string "+ncalrpc:[OLE368D8CBDDEE65CD2E9FAC7432057]" (Indicator: "ncalrpc"; Source: "00000000-00002104.00000000.295024.35CD0000.00000004.mdmp, 00000000-00002104.00000001.295324.35CD0000.00000004.mdmp") Found string "B+ncalrpc:[OLE8711EA166AA18F397F5B3A48CD2E]" (Indicator: "ncalrpc"; Source: "00000000-00002104.00000001.295324.35CD0000.00000004.mdmp, 00000000-00002104.00000001.295324.50205000.00000004.mdmp")7b:Tc61,"f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\csrsvvw\* (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\* (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindNextFileW" with parameter 46c2f46666e40896049aed7e4ed25573 (UID: 00000000-00002912) "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00002912)7c:T1822,Found string ")AESA" (Indicator: "aes"; File: "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe") Found string "GZipStream" (Indicator: "GzipStream"; File: "f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132.exe") Found string "P~AeS" (Indicator: "aes"; Source: "00000000-00002040.00000000.292734.00F4E000.00000004.mdmp") Found string "PQAeS~" (Indicator: "aes"; Source: "00000000-00002040.00000000.292734.00F4E000.00000004.mdmp") Found string "8$4,6-9'$6.:*?#1pHhX~AeSlZrNbS" (Indicator: "aes"; Source: "00000000-00002040.00000000.292734.00F4E000.00000004.mdmp") Found string "$4,8-9'66.:$?#1*HhXpAeS~ZrNlS" (Indicator: "aes"; Source: "00000000-00002040.00000000.292734.00F4E000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002104.00000000.295024.35CD0000.00000004.mdmp, 00000000-00002104.00000000.295024.37D10000.00000004.mdmp, 00000000-00002104.00000001.295324.35CD0000.00000004.mdmp, 00000000-00002104.00000001.295324.37D10000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002104.00000000.295024.35CD0000.00000004.mdmp, 00000000-00002104.00000001.295324.35CD0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002104.00000000.295024.37D10000.00000004.mdmp, 00000000-00002104.00000000.295024.37E20000.00000004.mdmp, 00000000-00002104.00000001.295324.37D10000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00002104.00000000.295024.37E20000.00000004.mdmp") Found string "[-WindowStyle