26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 6d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T421,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 99fcb39643ca… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 99fcb39643ca…. Threat score 100/100. 0/0 AV engines flagged this file. 4 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/99fcb39643ca26c4e57115a8a46541ddd06d046404ade37b1f40b75094a28af6","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","99fcb39643ca26c4e57115a8a46541ddd06d046404ade37b1f40b75094a28af6"],"about":{"@type":"SoftwareApplication","name":"Morteris.exe","applicationCategory":["compressed","7zip"],"identifier":"99fcb39643ca26c4e57115a8a46541ddd06d046404ade37b1f40b75094a28af6","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":4,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1101,"Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\locales\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-arm64 (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\darwin_arm64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\darwin_x64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\freebsd_arm64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\freebsd_ia32\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\freebsd_x64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_arm64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_armhf\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_ia32\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_loong64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_riscv64d\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_x64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\musl_arm64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\musl_x64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\openbsd_ia32\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\openbsd_x64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_arm64\ (UID: 00000000-00006012) "Morteris.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_ia32\ (UID: 00000000-00006012)28:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp")29:T962,"Morteris.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\PROGID") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\PROGID") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SYNCROOTMANAGER") "Morteris.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SYNCROOTMANAGER") "Morteris.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SYNCROOTMANAGER\") "Morteris.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "Morteris.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER32") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER32") "Morteris.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER") "Morteris.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "Morteris.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "Morteris.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE")2a:Ta12,"Morteris.exe" queried SystemProcessInformation at 00000000-00006012-00000C15-3368791753 [PID: 6012] "Morteris.exe" queried SystemProcessInformation at 00000000-00006012-00000C15-3368800028 [PID: 6012] "Morteris.exe" queried SystemProcessInformation at 00000000-00006012-00000C15-3368951201 [PID: 6012] "Morteris.exe" queried SystemProcessInformation at 00000000-00006012-00000C15-3368959557 [PID: 6012] "Morteris.exe" queried SystemProcessInformation at 00000000-00006012-00000C15-3370194961 [PID: 6012] "Morteris.exe" queried SystemProcessInformation at 00000000-00006012-00000C15-3370203529 [PID: 6012] "Morteris.exe" queried SystemProcessInformation at 00000000-00006012-00000C15-3393350624 [PID: 6012] "Morteris.exe" queried SystemProcessInformation at 00000000-00006012-00000C15-3393358138 [PID: 6012] "Morteris.exe" queried SystemProcessInformation at 00000000-00006012-00000C15-3413886523 [PID: 6012] "Morteris.exe" queried SystemProcessInformation at 00000000-00006012-00000C15-3413894845 [PID: 6012] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3371134722 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3371169922 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3372394109 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3372402272 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3373375003 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3373382992 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3373783760 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3373792875 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3373879703 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3373888161 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3374951475 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3376049700 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3376057143 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3376805328 [PID: 1964] "powershell.exe" queried SystemProcessInformation at 00000000-00001964-00000C15-3376814287 [PID: 1964]2b:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2c:T4fb,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Able to decrypt/decode data Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Reads the cryptographic machine GUID Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm2d:T1738e,Found XOR loop in file "vk_swiftshader.dll" at offset 960924; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 1520108; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 2174146; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 2175137; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 2175833; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4330968; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4468432; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4468448; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4468465; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4468482; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4468499; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4698664; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4743408; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 634249; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4150195; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4173094; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4173113; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4266552; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4366074; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4366138; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 5163500; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 584457; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 584679; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 716186; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 716237; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 718396; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 861804; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1450272; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1456106; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1459782; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1466396; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1540511; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1593980; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1727626; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1728600; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1752799; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1755602; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1787199; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1888412; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2294007; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2486882; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2487867; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2488386; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2488974; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2565297; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3345008; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3345195; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3345534; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3345707; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3606601; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4129996; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4682275; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 892684; code bytes = 30d0 Found XOR loop in file "Morteris.exe" at offset 893326; code bytes = 30d0 Found XOR loop in file "Morteris.exe" at offset 2616441; code bytes = 30d0 Found XOR loop in file "Morteris.exe" at offset 2616518; code bytes = 30d0 Found XOR loop in file "Morteris.exe" at offset 2652508; code bytes = 30d0 Found XOR loop in file "Morteris.exe" at offset 2718044; code bytes = 30d0 Found XOR loop in file "Morteris.exe" at offset 4419621; code bytes = 33c1 Found XOR loop in file "Morteris.exe" at offset 4419893; code bytes = 33c1 Found XOR loop in file "Morteris.exe" at offset 4420117; code bytes = 33c1 Found XOR loop in file "Morteris.exe" at offset 1335380; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 1463137; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2014873; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2015689; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2016583; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2017527; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2173975; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2175173; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2306658; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2309239; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2314450; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2317132; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2318795; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2323132; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2407976; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2636525; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2637994; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2639481; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2729504; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2777755; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2788187; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2997019; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 2998937; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3001844; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3003218; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3020642; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3025421; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3035541; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3241036; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3250871; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3250926; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3264315; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3267935; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3271693; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3274076; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3276319; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3276972; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3277859; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3329654; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3361920; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3380453; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3415865; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3481848; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3504586; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3524448; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3534041; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3536152; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3550390; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3571077; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3788699; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3789804; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3849506; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3903167; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 3905610; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 4197902; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 4208907; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 4243766; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 4385431; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 4385853; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 4401309; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 4401997; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 4851578; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 4970335; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 4974472; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5026691; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5029389; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5070780; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5070868; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5073150; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5081345; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5081549; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5082657; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5082861; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5083985; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5084189; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5084929; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5085133; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5085889; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5086093; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5086833; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5087037; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5087793; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5087997; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5088737; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5088941; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5089681; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5089885; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5090625; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5090829; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5091585; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5091789; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5092529; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5092733; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5094305; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5094509; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5096369; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5096573; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5128278; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5129609; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5132371; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5132846; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5134035; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5134510; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5135699; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5136174; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5137363; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5137838; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5139027; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5139502; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5140691; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5141166; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5142355; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5142830; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5144019; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5144494; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5145683; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5146158; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5147347; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5147822; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5149011; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5149486; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5150675; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5151150; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5152339; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5152814; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5154579; code bytes = 8030 Found XOR loop in file "Morteris.exe" at offset 5155054; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 109157; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 209480; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 238344; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 325057; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 364416; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 536055; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 564550; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 676215; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 695018; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 810761; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 837401; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 853231; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1027863; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1080157; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1103080; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1107825; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1172439; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1226749; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1245526; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1415741; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1567858; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1579338; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1618042; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1677235; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1727195; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1741106; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2031904; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2049422; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2258414; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2341400; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2475652; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2561649; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2623143; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2649661; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2667042; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2700580; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3035949; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3059802; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3220292; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3321127; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3542776; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3599909; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3639160; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3710367; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3804344; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3834169; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3836385; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3862784; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3870282; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3871588; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3911214; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3933387; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4153987; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4157826; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4201524; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4227319; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4238699; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4393713; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4444795; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4454541; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4456116; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4466782; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4495817; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4576742; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4615422; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4754879; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4781478; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4878676; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4898067; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4912295; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4988157; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 5131658; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 5141767; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 5142777; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 5152610; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 5187675; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 5214130; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 5229720; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 5237568; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 51617; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 100183; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 130003; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 156135; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 202085; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 251515; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 521130; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 867997; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 877131; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 960415; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1005027; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1106417; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1190042; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1217774; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1236955; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1245037; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1249617; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1402809; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1419024; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1420776; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1489557; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1554890; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1716576; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1924436; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2007139; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2022856; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2067915; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2161444; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2165409; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2174851; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2219886; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2253976; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2288638; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2392954; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2437609; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2454920; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2543062; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2557934; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2582278; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2630375; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2664266; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2684666; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2786156; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2816813; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2858887; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2863404; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2865913; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2956815; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2958502; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3035169; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3058161; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3127367; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3181814; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3328740; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3408077; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3476437; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3721936; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3771090; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3900858; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4051841; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4108515; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4112595; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4274205; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4282170; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4318839; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4447358; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4533347; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4630278; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4663829; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4704504; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4774663; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4788465; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4832127; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4839042; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4904253; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4936508; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4961205; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5011080; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5059161; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5065052; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5068553; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5095659; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5149177; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5203497; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 45281; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 61028; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 217703; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 231407; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 403643; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 429847; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 444806; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 454318; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 466436; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 519037; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 714166; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 733634; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 837638; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 889388; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 907267; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 947832; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 995411; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1002009; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1112551; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1130927; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1186663; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1190824; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1236015; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1360735; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1362710; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1370128; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1430400; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1464895; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1638309; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1744118; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1922114; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1948750; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1986132; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2270970; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2361513; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2452821; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2455788; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2705007; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2708185; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2813341; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2950237; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2965908; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3196089; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3240605; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3264909; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3332462; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3354102; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3519090; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3682399; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3837595; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4030715; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4182031; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4197694; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4233211; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4271638; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4322448; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4413510; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4540117; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4545628; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4625670; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4848797; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4855877; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4870840; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4877733; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4908488; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4910712; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5020975; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5030233; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5099698; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5124618; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5191579; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5222550; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1601307; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1601979; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1602595; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1603140; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1650919; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1652706; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1720656; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1721746; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1973534; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1976955; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2005110; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2132318; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2133918; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2135150; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2136382; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2137614; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2140270; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2146322; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2150094; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2151566; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2288076; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 3998829; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 4024462; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 4869775; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 4893270; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 4893289; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 5057065; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 5085016; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 5088618; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 5088682; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 13255; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 372683; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 374315; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 380436; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 408346; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 413997; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 414488; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 415236; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 419915; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 423997; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 517784; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 550289; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 568307; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 582616; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 743576; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 745350; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 920022; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 990270; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1237322; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1329915; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1336490; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1339318; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1345215; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1589447; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1589490; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1594795; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1596151; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1644230; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1644301; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1653091; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1653289; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1653424; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1653462; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1680418; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1682895; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1800940; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1853265; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1918686; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1919026; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2119230; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2224142; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2224168; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2231505; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2265900; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2692250; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2692637; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2723787; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2725380; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2725669; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2725925; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3422667; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3422726; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3469038; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3606597; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607481; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607508; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607538; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607568; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607598; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607628; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607658; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607688; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607718; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607748; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607778; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607808; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607838; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607868; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607898; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3607928; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3671716; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3671747; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3671781; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3671815; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3671849; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3671883; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3671917; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3671951; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3671985; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3672019; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3672053; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3672087; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3672121; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3672155; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3672189; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3672223; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673227; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673258; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673292; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673326; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673360; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673394; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673428; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673462; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673496; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673530; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673564; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673598; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673632; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673666; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673700; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3673734; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3678595; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699515; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699542; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699572; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699602; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699632; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699662; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699692; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699722; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699752; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699782; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699812; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699842; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699872; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699902; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699932; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3699962; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3710873; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711114; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711141; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711171; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711201; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711231; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711261; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711291; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711321; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711351; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711381; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711411; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711441; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711471; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711501; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711531; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3711561; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3757102; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3757434; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3878976; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3879005; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3879016; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3879132; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3879161; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3879172; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3887414; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3887446; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4088537; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4090699; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4152483; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4152809; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4153977; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4159877; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4170231; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4252448; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4329555; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4421476; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4825788; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 28465; code bytes = 30d0 Found XOR loop in file "dxcompiler.dll" at offset 825788; code bytes = 30d0 Found XOR loop in file "dxcompiler.dll" at offset 2402508; code bytes = 30d0 Found XOR loop in file "dxcompiler.dll" at offset 2402562; code bytes = 30d0 Found XOR loop in file "dxcompiler.dll" at offset 2402616; code bytes = 30d0 Found XOR loop in file "dxcompiler.dll" at offset 3176362; code bytes = 30d0 Found XOR loop in file "dxcompiler.dll" at offset 4423394; code bytes = 30d0 Found XOR loop in file "dxcompiler.dll" at offset 549369; code bytes = 33c1 Found XOR loop in file "dxcompiler.dll" at offset 887593; code bytes = 33c1 Found XOR loop in file "dxcompiler.dll" at offset 2838352; code bytes = 33c1 Found XOR loop in file "dxcompiler.dll" at offset 3586686; code bytes = 33c1 Found XOR loop in file "dxcompiler.dll" at offset 4926852; code bytes = 33c1 Found XOR loop in file "dxcompiler.dll" at offset 186553; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 513602; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 585696; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 586201; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 586700; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 590956; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 605984; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 765731; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1045164; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1090105; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1293788; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1679116; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1716232; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1739206; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1739228; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1739238; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1746842; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1747450; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 2047226; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 2717484; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 2784405; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 2906247; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 2968638; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3151356; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3368403; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3369646; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3369681; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3370942; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3522412; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3523068; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3527796; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4238801; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4391413; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4391907; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4663474; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4850335; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4883271; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4883511; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4953554; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4987645; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 5138520; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 154860; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3426470; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3426572; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3658312; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3658368; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3802091; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 4574828; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 4672956; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 88702; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 105289; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 105611; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 158153; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 196882; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 209731; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 216432; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 276786; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 276804; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 276884; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 279343; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 287505; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 287704; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405065; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405317; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405363; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405474; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405502; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405625; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405654; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405762; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405890; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 466731; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 480996; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 533012; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 533040; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 533249; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 817415; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 878022; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 960646; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1076295; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1098532; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1098553; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1102588; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1114876; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1150972; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1200849; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1200864; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1204613; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1392282; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1392301; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1496633; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1600316; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1648850; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1648888; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1648926; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1648969; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649012; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649055; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649098; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649141; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649184; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649227; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649270; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649313; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649356; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649399; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649442; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649529; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649567; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649605; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649648; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649691; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649734; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649777; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649820; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649863; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649906; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649949; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649992; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650035; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650078; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650121; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650208; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650246; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650284; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650327; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650370; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650413; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650456; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650499; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650542; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650585; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650628; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650671; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650714; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650757; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650800; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650882; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650887; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1974414; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2007987; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2016700; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2146815; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2150981; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2150996; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2151015; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2151022; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2166180; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2166229; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2166308; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2166357; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2348207; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2348214; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2380587; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2419710; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2419892; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2420248; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2477533; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2570945; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2572613; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2589793; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2613683; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2613704; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2614135; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2614187; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2629008; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2701460; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2701699; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2701746; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2701855; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2701875; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2702002; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2702032; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2702133; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2702280; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3149882; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3160600; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3174106; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3174170; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3291395; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3291416; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3295287; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3476637; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3508250; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3519379; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 42554; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 341293; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 341336; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 435925; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 435991; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 436113; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 436130; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 436203; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 436220; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 595188; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 632432; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 639547; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 641131; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 641579; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 701096; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 707215; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 707538; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 778907; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1013365; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1228448; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1594373; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1594501; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1657881; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1658649; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1659201; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1659969; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1660689; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1661457; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1661961; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1932677; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1933390; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1934011; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1935381; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1936734; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2519761; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2594765; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2806916; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2807053; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2807281; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2807631; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2807768; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2807920; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2811867; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2812530; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2812568; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2812705; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2812943; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2813068; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2813151; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2813636; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2813771; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2817459; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2817579; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2817698; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2817809; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2929986; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2933410; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2942601; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3041810; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3231164; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3244657; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3409136; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3416896; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3604104; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3635744; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3692320; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3773392; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3781334; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3792016; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3797211; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4329667; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4343973; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4343985; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4435056; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4435112; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4618008; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4653704; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4733627; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4733705; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4737142; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1162684; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2423864; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2438000; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2438016; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2438033; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2438050; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2438067; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2730648; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2736328; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 3011016; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 3040244; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 3046736; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 735057; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 771203; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 790854; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 790873; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 953641; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 976952; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 990730; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 990794; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1194571; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1301121; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1301222; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1301300; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1743712; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1764688; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1768368; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1772048; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1792656; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2181354; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2191931; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 19447; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 19696; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 39447; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 39696; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 59591; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 59816; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 78311; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 78536; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 97303; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 97528; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 116023; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 116248; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1137514; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1496985; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1497379; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1597000; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1759816; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1761948; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1762003; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2307061; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2531411; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1360428; code bytes = 30d0 Found XOR loop in file "dxil.dll" at offset 1377315; code bytes = 30d0 Found XOR loop in file "dxil.dll" at offset 1377451; code bytes = 30d0 Found XOR loop in file "dxil.dll" at offset 1377883; code bytes = 30d0 Found XOR loop in file "dxil.dll" at offset 198468; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 198564; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 198650; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 198864; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 199164; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 199690; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 199735; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 201153; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 206748; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 245811; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246050; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246097; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246199; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246219; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246353; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246383; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246477; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246627; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248456; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248695; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248742; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248844; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248864; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248998; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 249028; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 249122; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 249272; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 253466; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 254013; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 608356; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 618725; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 625321; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890651; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890668; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890685; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890702; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890753; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890768; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890773; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 893051; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 1002013; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 1086624; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 260224; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1202387; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1220764; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1360447; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1431968; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1431984; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1495739; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1499255; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 634176; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 634192; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 634209; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 634226; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 634243; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 882227; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 885663; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 899592; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 397507; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 417158; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 417177; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 13105; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 66377; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 81671; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 87154; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 90066; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 92978; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 98850; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 102738; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 105474; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 108306; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 111218; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 114130; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 116690; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 119602; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 122690; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 125602; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 234434; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 236194; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 236914; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 243122; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 245058; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 248338; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 253774; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 254130; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 256237; code bytes = 8030 Found XOR loop in file "libEGL.dll" at offset 384064; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 384080; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 384097; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 384114; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 384131; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 146643; code bytes = 33c1 Found XOR loop in file "libEGL.dll" at offset 169270; code bytes = 33c1 Found XOR loop in file "libEGL.dll" at offset 169289; code bytes = 33c1 Found XOR loop in file "libEGL.dll" at offset 300937; code bytes = 33c1 Found XOR loop in file "libEGL.dll" at offset 356905; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 377388; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 423495; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 429493; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 430733; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 432095; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 433473; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 14196; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32458; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32489; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32520; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 39010; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 66588; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 118788; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 266651; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 274623; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 274752; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 417293; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 16577; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 423456; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 424610; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 427782; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 428606; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 429474; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 430714; code bytes = 8030 Found XOR loop in file "Uninstall Morteris.exe" at offset 86862; code bytes = 30d0 Found XOR loop in file "Uninstall Morteris.exe" at offset 109300; code bytes = 30d0 Found XOR loop in file "Uninstall Morteris.exe" at offset 51617; code bytes = 33c1 Found XOR loop in file "Uninstall Morteris.exe" at offset 97023; code bytes = 33c1 Found XOR loop in file "Uninstall Morteris.exe" at offset 102744; code bytes = 33c1 Found XOR loop in file "Uninstall Morteris.exe" at offset 130146; code bytes = 33c1 Found XOR loop in file "Uninstall Morteris.exe" at offset 45281; code bytes = 8030 Found XOR loop in file "Uninstall Morteris.exe" at offset 61028; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 104839; code bytes = 30d0 Found XOR loop in file "elevate.exe" at offset 9341; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 38220; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 38617; code bytes = 8030 Found XOR loop in file "StdUtils.dll" at offset 101399; code bytes = 30d0 Found XOR loop in file "StdUtils.dll" at offset 2707; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 2896; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 3088; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 30152; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 30569; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34552; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34557; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34719; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 37953; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 37960; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 40217; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 43107; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 43120; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 101360; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3377; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3457; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3642; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 2258048; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 2356352; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 145909; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 145923; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 145937; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 156784; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 164936; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 164998; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 165026; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 174888; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 176354; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 229654; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 230197; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 230211; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 230225; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 232001; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 232015; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 232029; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 240849; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 244425; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 244439; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 244457; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 251424; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 272586; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 272600; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1648836; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1761183; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1821601; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 398508; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1808225; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 2196728; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 2295032; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1313388; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1341196; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1569164; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1659199; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1719617; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 26312; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 157384; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 288456; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 419528; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 559928; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 740152; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 920376; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 963248; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1100600; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1706241; code bytes = 8030 Found XOR loop in file "node_sqlite3.node" at offset 1589912; code bytes = 30d0 Found XOR loop in file "node_sqlite3.node" at offset 1809004; code bytes = 30d0 Found XOR loop in file "node_sqlite3.node" at offset 182633; code bytes = 33c1 Found XOR loop in file "node_sqlite3.node" at offset 182833; code bytes = 33c1 Found XOR loop in file "node_sqlite3.node" at offset 353869; code bytes = 33c1 Found XOR loop in file "node_sqlite3.node" at offset 353879; code bytes = 33c1 Found XOR loop in file "node_sqlite3.node" at offset 1053588; code bytes = 33c1 Found XOR loop in file "node_sqlite3.node" at offset 1278572; code bytes = 33c1 Found XOR loop in file "node_sqlite3.node" at offset 1406672; code bytes = 33c1 Found XOR loop in file "node_sqlite3.node" at offset 1474368; code bytes = 33c1 Found XOR loop in file "node_sqlite3.node" at offset 1553395; code bytes = 8030 Found XOR loop in file "node_sqlite3.node" at offset 1765920; code bytes = 8030 Found XOR loop in file "node_sqlite3.node" at offset 1766112; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1711659; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1718295; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1720351; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1722407; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1724463; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1726519; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1728575; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1730631; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1732687; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1734743; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1736799; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1738855; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1740911; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1742967; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1745023; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1747079; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1749135; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1750955; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1751327; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1753113; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 1755615; code bytes = 30d0 Found XOR loop in file "koffi.node" at offset 5626; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 5848; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 6008; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 55971; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 55984; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 64510; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 65427; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 118927; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 118986; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 149100; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 149114; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 149184; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 149331; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 149715; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 150247; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 150395; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 197581; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 199565; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 206898; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 206911; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 209661; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 209803; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 212346; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 212870; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 214794; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 214823; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 214852; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 215743; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 215754; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 238096; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1045913; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1398729; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1403055; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1503127; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 1563545; code bytes = 33c1 Found XOR loop in file "koffi.node" at offset 77860; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 182268; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1392028; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1392039; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1550169; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1711330; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1718256; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1720312; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1722368; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1724424; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1726480; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1728536; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1730592; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1732648; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1734704; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1736760; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1738816; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1740872; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1742928; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1744984; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1747040; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1749096; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1751308; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1753384; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1754116; code bytes = 8030 Found XOR loop in file "koffi.node" at offset 1755576; code bytes = 80302e:T454,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "Morteris.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "Morteris.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "Morteris.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "nsis7z.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "Uninstall Morteris.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "SpiderBanner.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "nsExec.dll") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00001964-00000C2C-3373738746") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00001964-00000C2C-3373738769") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002200-00000C2C-3428696270") Found reference to API "postMessage" (Indicator: "postmessage"; Source: "00000000-00001460.00000000.287576.DE510000.00000002.mdmp")2f:T315e,"Morteris.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f80016e17e7418eff80010eff8001ceff8000200000080f6357528eff800aaec7e740200000000000000e4478772b6ec7e746159a0dc60eff8007de07e7464e07e742959a0dce447877205000000f09d87720000000075e2877286e28772e0eff800802b817429f0d3a8feffffff6ceff800e0df7e74200289727ceff80049d98872c0648b722002897288eff80063d9887220028972aceff800fa9d8772010000000100000037064477010000000b2e7f7406000000dad88872f0eff800eecf8872c4dc8872e2cf8872a520258d0100000001000000000000001c364a8e18000000eceff80032ba4677a0688b7200000000000000000000000000f0f800 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000008cdf80038cf4577a439fe0274cdf800010000005839fe02a439fe025839fe02040000000400000000e040750010000074cdf800010000005839fe02cd9745779c97457714164a8eb50f37755839fe020000457700000000841548740000000080ee3d75010000001b800800f8e2407500000000040000000000000048403f75f8e2407578cdf80080e85e75e8a8fe0280e85e7574cdf8000000000080e85e75a0cdf8001b80080028cef80058060000c8d4f800642aab73cca62643f30b0000faffffffe0d4f8000000000018000000000000005f682b6f0000000000000000ffffffff000000000000000000000000060001031c000103 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000f80028cef8001b800800cc569600fc01000000000000000000000000000008cef8001b80080090cef8005806000030d5f800180000005f682b6ffc010000000000009f579672fc010000fc01000000000000000000000000f80000000000000000001800000030d5f80090cef8001b800800f7682b6fa0ccf8009f579672b8cdf800a01898723f534a1dfeffffffc8cdf800222aab73fc010000000000000000000000000000a0cdf8001b80080028cef80058060000c8d4f800642aab73cca62643f30b0000faffffffe0d4f8000000000018000000000000005f682b6f0000000000000000ffffffff000000000000000000000000362501034e250103 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000f80028cef8001b800800cc569600fc01000000000000000000000000000008cef8001b80080090cef8005806000030d5f800180000005f682b6ffc010000000000009f579672fc010000fc01000000000000000000000000f80000000000000000001800000030d5f80090cef8001b800800f7682b6fa0ccf8009f579672b8cdf800a01898723f534a1dfeffffffc8cdf800222aab73fc010000000000000000000000000000a0cdf8001b80080028cef80058060000c8d4f800642aab73cca62643f30b0000faffffffe0d4f8000000000018000000000000005f682b6f0000000000000000ffffffff000000000000000000000000ae0d0103c20d0103 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000f80028cef8001b800800cc569600fc01000000000000000000000000000008cef8001b80080090cef8005806000030d5f800180000005f682b6ffc010000000000009f579672fc010000fc01000000000000000000000000f80000000000000000001800000030d5f80090cef8001b800800f7682b6fa0ccf8009f579672b8cdf800a01898723f534a1dfeffffffc8cdf800222aab73fc010000000000000000000000000000a0cdf8001b80080028cef80058060000c8d4f800642aab73cca62643f30b0000faffffffe0d4f8000000000018000000000000005f682b6f0000000000000000ffffffff000000000000000000000000ee15010306160103 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000f80028cef8001b800800cc569600fc01000000000000000000000000000008cef8001b80080090cef8005806000030d5f800180000005f682b6ffc010000000000009f579672fc010000fc01000000000000000000000000f80000000000000000001800000030d5f80090cef8001b800800f7682b6fa0ccf8009f579672b8cdf800a01898723f534a1dfeffffffc8cdf800222aab73fc010000000000000000000000000000a0cdf8001b80080028cef80058060000c8d4f800642aab73cca62643f30b0000faffffffe0d4f8000000000018000000000000005f682b6f0000000000000000ffffffff000000000000000000000000b6af0103ccaf0103 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000f80028cef8001b800800cc569600fc01000000000000000000000000000008cef8001b80080090cef8005806000030d5f800180000005f682b6ffc010000000000009f579672fc010000fc01000000000000000000000000f80000000000000000001800000030d5f80090cef8001b800800f7682b6fa0ccf8009f579672b8cdf800a01898723f534a1dfeffffffc8cdf800222aab73fc010000000000000000000000000000a0cdf8001b80080028cef80058060000c8d4f800642aab73cca62643f30b0000faffffffe0d4f8000000000018000000000000005f682b6f0000000000000000ffffffff000000000000000000000000deb40103f6b40103 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000f80028cef8001b800800cc569600fc01000000000000000000000000000008cef8001b80080090cef8005806000030d5f800180000005f682b6ffc010000000000009f579672fc010000fc01000000000000000000000000f80000000000000000001800000030d5f80090cef8001b800800f7682b6fa0ccf8009f579672b8cdf800a01898723f534a1dfeffffffc8cdf800222aab73fc010000000000000000000000000000a0cdf8001b80080028cef80058060000c8d4f800642aab73cca62643f30b0000faffffffe0d4f8000000000018000000000000005f682b6f0000000000000000ffffffff00000000000000000000000006b401031eb40103 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f80070bcc304c000c304c06ff97278bcc30470eef80058eef800d06ff97294bcc304a74df9720000000078bcc304b74df972543f78c64ebcfc7200000000e0bfff02aceef8008ceef800c06ff97278bcc304c4eef80098eef800d06ff9720000000000000000000000008c584f74b74df972943f78c60000000038374a8e70bcc30402400080f8eef800506a4877e02ce2f9feffffff08eff80000165f74d80b000354b0087323874577e186457788364a8e000000008c584f7470bcc30400000000d80b00030400000000165f74d0eef80070bcc304b04d5a74f56c190900000000e0bfff0270bcc30413e6fb720000f3722c530873fceef80080ee3d75 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000064f3a007c5902e72409c3072a0f3a0079f732e72020000008f732e72eacfc5921400000058222f72150000000000000074f3a0070000000040f4a007302b2e72420855e7feffffff8f732e7266762e72bcf3a007b4f3a007c0f3a007d0f3a007d4f3a00702000000020000002ee82a72d8f3a007d9752e7200993072f21c2f72e4f3a007ca152e72f21c2f72f0f3a007ee152e72f21c2f7210f4a0070e112a72f21c2f7209782e720100000001000000010000006b152e7250f4a0074b172e720000000001172e721ac8c592010000000100000000000000180000000000000020f4a0074008000090f4a007302b2e72d20c55e7feffffff60f4a007 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000064dca0075243487743000000b8dca00773f63475fadca0075c00000000000000fdfeff7f82f83475000000002c5afe01feffffff00000000000000000000000005000000d882a20502000000020000000a000000c882a205d882a20500000000cc4586d600dfa007ddf33475f4dca00700000000c882a2050a000000f8f33475c882a205 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000010300000000e7c05c75000000004a0000003cb100036400000016fe996f78dba00735876375000000004004a3052a00000090db010378dba0074c8763755c87637546fe996f38b100034004a30510b4a40510b4a4050000000038b1000390db01031cdfa00700000000e02cc3045c876375c88463754004a30510b4a4050000000000000000807f6375b485637500000000000000000000000000000000f8b3a4054004a30538b10003e02cc30440e0a0071ce0a00781f1e774e02cc30458e5a007e8e1a007c5f1e7740000fe02983445770853a30548e0a0071c60e4740400000040e0a0075c835375d82cc304a090eb74000000000000000000000000 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000a0074034997201000000acdca007a54f96720000f00f00000000003c3475c9509672000000000000000081001000000000000000000000000000e02cc30407000000af79736878dba00700000000000000000000000000004a1dfeffffffa0dca007222aab73fc01000000000000000000000000000078dca00764dca0075243487743000000b8dca00773f63475fadca0075c00000000000000fdfeff7f82f83475000000002c5dfe01feffffff00000000000000000000000005000000d87fa20502000000020000000a000000c87fa205d87fa20500000000cc4586d600dfa007ddf33475f4dca00700000000c87fa2050a000000f8f33475c87fa205 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000010000010000000000000001cf6d010000000000000080dba007854a6b75df876375befe996f38b100034004a30548b3a405a4cf5275a4cf5275f77e736800000000000000001cdfa007a01898725f534a1dfeffffff0000a007881a3575b31a357538b1000300000000e02cc3040000000028dfa0078b846375330000000000000000000000807f6375b485637578dca007000000000000000085bfdc0130b3a4054004a30538b10003e02cc30440e0a0071ce0a00781f1e774e02cc30458e5a007e8e1a007c5f1e7740000fe02983445770853a30548e0a0071c60e4740400000040e0a0075c835375d82cc304a090eb74000000000000000081001000 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000005400000000000000490000006835fe0202000101020000006835fe0200000000d061a305540000546035fe020000a00700e5a00700000000e02cc304c000fe02ef407368b8e4a00724e6a001000000000000000000004a1dfeffffffe0e5a007222aab73fc010000000000000000000000000000b8e5a007a4e5a0075243487743000000f8e5a00773f634753ae6a0075c00000000000000fdfeff7f82f8347500000000bc931cfefeffffff000000000000000000000000050000008852840902000000020000000a0000007852840988528409000000008c7c86d640e8a007ddf3347534e6a00700000000785284090a000000f8f3347578528409 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003091a5054491a505 (UID: 00000000-00006012) "Morteris.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000010000010000000000000001cf6d0100000000000000c0e4a007854a6b75df876375fec1996f38b100039005970b70a8940ba4cf5275a4cf52753741736800000000000000005ce8a007a01898725f534a1dfeffffff0000a007881a3575b31a357538b1000300000000e02cc3040000000068e8a0078b846375330000000000000000000000807f6375b4856375b8e5a007000000000000000085bfdc0158a8940b9005970b38b10003e02cc30480e9a0075ce9a00781f1e774e02cc30498eea00728eba007c5f1e77402000000b21ae8745400000088e9a0071c60e4740400000080e9a0075c835375d82cc304a090eb7400000000540000546035fe02 (UID: 00000000-00006012)30:T75e,"Morteris.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000a00943030000000070edf800591645770100000008000000010000000000fe020000000010000000000000000000000002000000020000000000fe0201000000080000000000000090edf800ee13457701000000ee13457708000000000000000800000097a5d36fc8eff800ad9c81720000fe020800000001000000 (UID: 00000000-00006012) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c0000000000630000000000000001000000740014000000f8fb4903000000000100000001000000000000002c00000070124a0300000000140000000a000000000000000000000000006f0070d1490314000000000000000000000000000000000000000000000000006e0000000000670000000b00000b (UID: 00000000-00001964) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000041038000000000000000a11400002cd21b0aee13457780000000ee134577000000000000000080000000f062396e000000004cd21b0a5072b775000041030000000080000000f062396e02000000002f396e68d21b0afb62396e0100000080043a6e885fb97500000000d60d3b2098d21b0ab864396ef42e396e (UID: 00000000-00001964) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f006e0000005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e00660069006700050000056525000038b51503c04515032e0063006f006e0066006900670000006c006c00 (UID: 00000000-00007036) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000004d038000000000000000a114000024d1080aee13457780000000ee134577000000000000000080000000f062396e0000000044d1080a5072b77500004d030000000080000000f062396e02000000002f396e60d1080afb62396e0100000080043a6e885fb97500000000970248ef90d1080ab864396ef42e396e (UID: 00000000-00007036)31:Tc1f,"Morteris.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")32:T498,"Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "")33:T146f,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00001964-00000C17-3372340865 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00001964-00000C17-3372565013 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00001964-00000C17-3374480435 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001964-00000C17-3374525691 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00001964-00000C17-3374610971 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00001964-00000C17-3374628620 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001964-00000C17-3374692741 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001964-00000C17-3374718805 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001964-00000C17-3374719055 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00001964-00000C17-3375329140 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001964-00000C17-3375414980 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001964-00000C17-3375424165 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001964-00000C17-3375424417 "powershell.exe" queries volume information of "C:\" at 00000000-00001964-00000C17-3376152563 "powershell.exe" queries volume information of "C:\share" at 00000000-00001964-00000C17-3376153865 "powershell.exe" queries volume information of "C:\share" at 00000000-00001964-00000C17-3376257112 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001964-00000C17-3377657335 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001964-00000C17-3378293793 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001964-00000C17-3378477865 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001964-00000C17-3378723654 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001964-00000C17-3378815389 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll" at 00000000-00001964-00000C17-3378904581 "powershell.exe" queries volume information of "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll" at 00000000-00001964-00000C17-3378985153 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00001964-00000C17-3379225642 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00001964-00000C17-337925140534:T83fe,"Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %TEMP%\nsgE14.tmp\System.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %TEMP%\nsgE14.tmp\StdUtils.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %TEMP%\nsgE14.tmp\SpiderBanner.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %TEMP%\nsgE14.tmp\nsExec.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter psapi (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %TEMP%\nsgE14.tmp\nsis7z.dll (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006012) "Morteris.exe" called "LoadLibrary" with a parameter %TEMP%\nsgE14.tmp\WinShell.dll (UID: 00000000-00006012) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001964) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Ibaae5ed9#\d7574833d2797c3e1bbd2ebc33911c6a\Microsoft.IIS.Powershell.Comm (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Kd58820a5#\73c2c8627fee7863c44684ef9b2f3a21\Microsoft.KeyDistributionServ (UID: 00000000-00007036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDis (UID: 00000000-00007036) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-power-base-l1-1-0.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter \\?\%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\sqlite3\lib\binding\napi-v6-win32-un (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter \\?\%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\@p (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter \\?\%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_x64\koffi.no (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002200) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DXCore.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\mf.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Morteris\D3DCompiler_47.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Morteris\libglesv2.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Morteris\libegl.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Morteris\libGLESv2.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter dcomp.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Morteris\vk_swiftshader.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Morteris\dxil.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Morteris\dxcompiler.dll (UID: 00000000-00006604) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00001460) "Morteris.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001460)35:T34b6,Found reference to API (Indicator: "MulDiv"; File: "Morteris.exe") Found reference to API (Indicator: "DeleteFileW"; File: "Morteris.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "Morteris.exe") Found reference to API (Indicator: "FindNextFileW"; File: "Morteris.exe") Found reference to API (Indicator: "FindClose"; File: "Morteris.exe") Found reference to API (Indicator: "SetFilePointer"; File: "Morteris.exe") Found reference to API (Indicator: "ReadFile"; File: "Morteris.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Morteris.exe") Found reference to API (Indicator: "lstrlenA"; File: "Morteris.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Morteris.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "Morteris.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "Morteris.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Morteris.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Morteris.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "Morteris.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "Morteris.exe") Found reference to API (Indicator: "GlobalFree"; File: "Morteris.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "Morteris.exe") Found reference to API (Indicator: "lstrcmpW"; File: "Morteris.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "Morteris.exe") Found reference to API (Indicator: "CloseHandle"; File: "Morteris.exe") Found reference to API (Indicator: "SetFileTime"; File: "Morteris.exe") Found reference to API (Indicator: "CompareFileTime"; File: "Morteris.exe") Found reference to API (Indicator: "SearchPathW"; File: "Morteris.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "Morteris.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "Morteris.exe") Found reference to API (Indicator: "MoveFileW"; File: "Morteris.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "Morteris.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "Morteris.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "Morteris.exe") Found reference to API (Indicator: "Sleep"; File: "Morteris.exe") Found reference to API (Indicator: "GetTickCount"; File: "Morteris.exe") Found reference to API (Indicator: "GetFileSize"; File: "Morteris.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Morteris.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Morteris.exe") Found reference to API (Indicator: "CopyFileW"; File: "Morteris.exe") Found reference to API (Indicator: "ExitProcess"; File: "Morteris.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "Morteris.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "Morteris.exe") Found reference to API (Indicator: "GetTempPathW"; File: "Morteris.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "Morteris.exe") Found reference to API (Indicator: "GetVersion"; File: "Morteris.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Morteris.exe") Found reference to API (Indicator: "lstrlenW"; File: "Morteris.exe") Found reference to API (Indicator: "lstrcpynW"; File: "Morteris.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "Morteris.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "Morteris.exe") Found reference to API (Indicator: "GlobalLock"; File: "Morteris.exe") Found reference to API (Indicator: "CreateThread"; File: "Morteris.exe") Found reference to API (Indicator: "GetLastError"; File: "Morteris.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "Morteris.exe") Found reference to API (Indicator: "CreateProcessW"; File: "Morteris.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Morteris.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "Morteris.exe") Found reference to API (Indicator: "CreateFileW"; File: "Morteris.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "Morteris.exe") Found reference to API (Indicator: "WriteFile"; File: "Morteris.exe") Found reference to API (Indicator: "lstrcpyA"; File: "Morteris.exe") Found reference to API (Indicator: "MoveFileExW"; File: "Morteris.exe") Found reference to API (Indicator: "lstrcatW"; File: "Morteris.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "Morteris.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Morteris.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Morteris.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Morteris.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Morteris.exe") Found reference to API (Indicator: "FillRect"; File: "Morteris.exe") Found reference to API (Indicator: "GetClientRect"; File: "Morteris.exe") Found reference to API (Indicator: "BeginPaint"; File: "Morteris.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "Morteris.exe") Found reference to API (Indicator: "InvalidateRect"; File: "Morteris.exe") Found reference to API (Indicator: "EnableWindow"; File: "Morteris.exe") Found reference to API (Indicator: "ReleaseDC"; File: "Morteris.exe") Found reference to API (Indicator: "GetDC"; File: "Morteris.exe") Found reference to API (Indicator: "LoadImageW"; File: "Morteris.exe") Found reference to API (Indicator: "IsWindow"; File: "Morteris.exe") Found reference to API (Indicator: "wsprintfW"; File: "Morteris.exe") Found reference to API (Indicator: "ShowWindow"; File: "Morteris.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "Morteris.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "Morteris.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "Morteris.exe") Found reference to API (Indicator: "SetTimer"; File: "Morteris.exe") Found reference to API (Indicator: "DestroyWindow"; File: "Morteris.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "Morteris.exe") Found reference to API (Indicator: "CharNextW"; File: "Morteris.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "Morteris.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "Morteris.exe") Found reference to API (Indicator: "RegisterClassW"; File: "Morteris.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Morteris.exe") Found reference to API (Indicator: "GetWindowRect"; File: "Morteris.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "Morteris.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "Morteris.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "Morteris.exe") Found reference to API (Indicator: "SetWindowPos"; File: "Morteris.exe") Found reference to API (Indicator: "GetSysColor"; File: "Morteris.exe") Found reference to API (Indicator: "SetCursor"; File: "Morteris.exe") Found reference to API (Indicator: "LoadCursorW"; File: "Morteris.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "Morteris.exe") Found reference to API (Indicator: "CloseClipboard"; File: "Morteris.exe") Found reference to API (Indicator: "SetClipboardData"; File: "Morteris.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "Morteris.exe") Found reference to API (Indicator: "OpenClipboard"; File: "Morteris.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "Morteris.exe") Found reference to API (Indicator: "AppendMenuW"; File: "Morteris.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "Morteris.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "Morteris.exe") Found reference to API (Indicator: "CharPrevW"; File: "Morteris.exe") Found reference to API (Indicator: "CharNextA"; File: "Morteris.exe") Found reference to API (Indicator: "wsprintfA"; File: "Morteris.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "Morteris.exe") Found reference to API (Indicator: "PeekMessageW"; File: "Morteris.exe") Found reference to API (Indicator: "SelectObject"; File: "Morteris.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "Morteris.exe") Found reference to API (Indicator: "DeleteObject"; File: "Morteris.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "Morteris.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "Morteris.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "Morteris.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "Morteris.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "Morteris.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "Morteris.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "Morteris.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "Morteris.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "Morteris.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "Morteris.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "Morteris.exe") Found reference to API (Indicator: "RegCloseKey"; File: "Morteris.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "Morteris.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "Morteris.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "Morteris.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "Morteris.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "Morteris.exe") Found reference to API (Indicator: "SetFileSecurityW"; File: "Morteris.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "Morteris.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "Morteris.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Morteris.exe") Found reference to API (Indicator: "OleUninitialize"; File: "Morteris.exe") Found reference to API (Indicator: "OleInitialize"; File: "Morteris.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Morteris.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "Morteris.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "Morteris.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "Morteris.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "Morteris.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "Morteris.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "Morteris.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "Morteris.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "Morteris.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "Morteris.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00001964.00000001.282006.00191000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00001964.00000001.282006.00191000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00001964.00000001.282006.00191000.00000020.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00001460.00000001.287612.DC5B0000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001964.00000000.281613.6EA81000.00000020.mdmp, 00000000-00001964.00000001.282006.00191000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001964.00000000.281613.6EA81000.00000020.mdmp, 00000000-00001964.00000001.282006.00191000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001964.00000000.281613.6EA81000.00000020.mdmp, 00000000-00001964.00000001.282006.00191000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001964.00000000.281613.6EA81000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001964.00000000.281613.6EA81000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00001964.00000000.281613.6EA81000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001964.00000000.281613.6EA81000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001964.00000000.281613.6EA81000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00001964.00000000.281613.6EA81000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001964.00000000.281613.6EA81000.00000020.mdmp, 00000000-00001964.00000001.282006.6EA95000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001964.00000000.281613.6EA81000.00000020.mdmp")36:T7d3,Found string "Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-CimInstance"; File: "AMSI") Found string "Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimInstance"; File: "AMSI") Found string "Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Remove-CimInstance"; File: "AMSI") Found string "Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Invoke-CimMethod"; File: "AMSI") Found string "Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimAssociatedInstance"; File: "AMSI") Found string "Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Register-CimIndicationEvent"; File: "AMSI") Found string "Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSession"; File: "AMSI") Found string "Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Remove-CimSession"; File: "AMSI") Found string "Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimSession"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSession"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSessionOption"; File: "AMSI") Found string "Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimClass"; File: "AMSI")37:T14fd,"Software\Microsoft\Windows\CurrentVersion" in Source: Morteris.exe "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 44415-159-0019D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 44415-194-00198190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 44415-194-00198190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 44415-194-00198190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 44415-196-0019BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 44415-207-00198AF0 "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001964.00000000.281613.03480000.00000004.mdmp 00000000-00001964.00000001.282006.03480000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001964.00000000.281613.03480000.00000004.mdmp 00000000-00001964.00000001.282006.03480000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp38:T894,Process Morteris.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6012:64:WilError_01" Process Morteris.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6012:168:WilStaging_02" Process Morteris.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process Morteris.exe created mutex with name "Local\SM0:6012:168:WilStaging_02" Process Morteris.exe created mutex with name "SM0:6012:64:WilError_01" Process Morteris.exe created mutex with name "Local\SM0:6012:64:WilError_01" Process Morteris.exe created mutex with name "759e0dba-0b28-5295-ab4a-a7726a0665a8" Process Morteris.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6012:64:WilError_01" Process Morteris.exe created mutex with name "\Sessions\1\BaseNamedObjects\759e0dba-0b28-5295-ab4a-a7726a0665a8" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1964:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1964:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1964:64:WilError_01" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:1964:64:WilError_01" Process powershell.exe created mutex with name "Local\SM0:1964:168:WilStaging_02" Process powershell.exe created mutex with name "SM0:1964:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:1964:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1964:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7036:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7036:168:WilStaging_02"39:Tc59,Antivirus vendors marked dropped file "vk_swiftshader.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "installer.exe" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"), Antivirus vendors marked dropped file "libGLESv2.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"), Antivirus vendors marked dropped file "dxcompiler.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "d3dcompiler_47.dll" as clean (type is "PE32+ executable for MS Windows 6.02 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "ffmpeg.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "dxil.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "vulkan-1.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "libEGL.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"), Antivirus vendors marked dropped file "nsis7z.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "Uninstall Morteris.exe" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"), Antivirus vendors marked dropped file "elevate.exe" as clean (type is "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"), Antivirus vendors marked dropped file "StdUtils.dll" as clean (type is "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "urlref_httpswww.drivereasy.com" as clean (type is "HTML document Unicode text UTF-8 text with very long lines (8856) with CRLF LF line terminators"), Antivirus vendors marked dropped file "System.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "SpiderBanner.dll" as clean (type is "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "nsExec.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "Morteris.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Programs\Morteris\Morteris.exe" MachineID a0eylqtclgodr0i KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Sun Mar 29 14:07:14 2026 atime=Sun Mar 29 14:07:14 2026 mtime=Fri Mar 20 13:24:14 2026 length=222860800 window=normal IDListSize 0x0228 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Programs\Morteris\Morteris.exe"")3a:Te9a,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll" - [base:0; Status:c0000135] "Morteris.exe" failed to load missing module "%WINDIR%\system32\DXCore.dll" - [base:0; Status:c0000135]3b:T525b,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001964.00000000.281613.03480000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001964.00000000.281613.03480000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00001964.00000000.281613.057D0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001964.00000001.282006.00191000.00000020.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001964.00000001.282006.03480000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001964.00000001.282006.03480000.00000004.mdmp "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001964.00000001.282006.07C30000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001964.00000001.282006.07C30000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001964.00000001.282006.07C30000.00000004.mdmp "ne\Software\Classes\AppID\Morteris.exe" in Source: 00000000-00002200.00000000.285223.DD010000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions" in Source: 00000000-00002200.00000001.287144.19F90000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.18112.10711.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities" in Source: 00000000-00002200.00000001.287144.19F90000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.2.11280.0_x86__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000001.287144.19F90000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.18112.14311.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities" in Source: 00000000-00002200.00000001.287144.19F90000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.3DBuilder_16.0.2611.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Print3D_3.1.2612.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "AppXmgj48ewmzzwt11zq319t7591v59qteen20Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.16299.15.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "AppXcfnvpx69kmg1gg1e37pyj3sk3k3azq74deSoftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11029.20108.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "\REGISTRY\MACHINE\Software\Adobe\Acrobat Reader\11.0\Capabilities\UrlAssociations" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS\REGISTRY\MACHINE\Software\WOW6432Node\Adobe\Acrobat Reader\11.0\Capabilities\UrlAssociations" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "\REGISTRY\MACHINE\S\RE\\REGISTRY\MACHINE\Software\WOW6432Node\Adobe\Acrobat Reader\11.0\Capabilities\UrlAssociations=DESKTOP-FVV" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "Y\MACHINE\Software\Adobe\Acrobat Reader\11.0\Capabilities\UrlAssociations" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "tings\Software\M(" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.20921.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1804.2492.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11029.20108.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11029.20108.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_44.44.7002.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1804.1101.1000_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1804.911.1000_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.18112.20010.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000001.287144.1A002000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Messaging_4.1810.2922.0_x64__8wekyb3d8bbwe\x27e26f40ye031y48a6yb130yd1f20388991ax\Capabilities" in Source: 00000000-00002200.00000001.287144.DD010000.00000004.mdmp "2jq5f320Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.16299.15_neutral_neutral_cw5n1h2txyewy\App\Capabilities" in Source: 00000000-00002200.00000001.287144.DD010000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_5.1811.27012.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities" in Source: 00000000-00002200.00000001.287144.DD010000.00000004.mdmp "AppX0whgdv29kss43gc8fza464m7j7gjhmwvrrSoftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.3.3472.2000_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities" in Source: 00000000-00002200.00000001.287144.DD010000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}" in Source: 00000000-00002200.00000001.287144.DD010000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}" in Source: 00000000-00002200.00000001.287144.DD010000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13371.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000001.287144.DD010000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13371.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000001.287144.DD010000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Morteris.exe" in Source: 00000000-00002200.00000002.287700.19F90000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions" in Source: 00000000-00002200.00000002.287700.19F90000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.18112.10711.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities" in Source: 00000000-00002200.00000002.287700.19F90000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.2.11280.0_x86__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000002.287700.19F90000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.18112.14311.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities" in Source: 00000000-00002200.00000002.287700.19F90000.00000004.mdmp "35145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002200.00000002.287700.DD010000.00000004.mdmp "8355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002200.00000002.287700.DD010000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13371.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000002.287700.DD0F2000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13371.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002200.00000002.287700.DD0F2000.00000004.mdmp "Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00006604.00000001.287676.17714000.00000002.mdmp "Software\Microsoft\VisualStudio\MSPDB" in Source: 00000000-00006604.00000001.287676.17714000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007036.00000000.282353.03150000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00007036.00000000.282353.03150000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDCFD26B-FEED-44CD-B71" in Source: 00000000-00007036.00000000.282353.03150000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007036.00000000.282353.03150000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007036.00000000.282353.055F0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007036.00000001.282735.03150000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00007036.00000001.282735.03150000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDCFD26B-FEED-44CD-B71" in Source: 00000000-00007036.00000001.282735.03150000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007036.00000001.282735.031DC000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007036.00000001.282735.07A8E000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00007036.00000001.282735.09170000.00000004.mdmp3c:T4db2,"Morteris.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75260000 "Morteris.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75260000 "Morteris.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75260000 "Morteris.exe" loaded module "KERNEL32" at base 74260000 "Morteris.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72900000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738e0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 728d0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 74a10000 "Morteris.exe" loaded module "NTDLL.DLL" at base 77410000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d80000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73380000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 729d0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 73e20000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 72870000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 75c70000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 72dc0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73b60000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 72860000 "Morteris.exe" loaded module "KERNEL32.DLL" at base 74260000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 72f20000 "Morteris.exe" loaded module "%TEMP%\NSGE14.TMP\SYSTEM.DLL" at base 72850000 "Morteris.exe" loaded module "%TEMP%\NSGE14.TMP\STDUTILS.DLL" at base 72830000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 727b0000 "Morteris.exe" loaded module "COMCTL32.DLL" at base 730a0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 743a0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74160000 "Morteris.exe" loaded module "OLEAUT32.DLL" at base 740b0000 "Morteris.exe" loaded module "RPCRT4.DLL" at base 73ea0000 "Morteris.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 77080000 "Morteris.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 77080000 "Morteris.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 744f0000 "Morteris.exe" loaded module "%TEMP%\NSGE14.TMP\SPIDERBANNER.DLL" at base 72320000 "Morteris.exe" loaded module "%TEMP%\NSGE14.TMP\NSEXEC.DLL" at base 72310000 "Morteris.exe" loaded module "PSAPI" at base 75b20000 "Morteris.exe" loaded module "%TEMP%\NSGE14.TMP\NSIS7Z.DLL" at base 722a0000 "Morteris.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77240000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75d30000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 754d0000 "Morteris.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d30000 "Morteris.exe" loaded module "SHELL32.DLL" at base 75d30000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\NTSHRUI.DLL" at base 72250000 "Morteris.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 740b0000 "Morteris.exe" loaded module "OLEAUT32" at base 740b0000 "Morteris.exe" loaded module "%WINDIR%\SYSWOW64\ONECORECOMMONPROXYSTUB.DLL" at base 72150000 "Morteris.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 71e70000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75260000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75260000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75260000 "powershell.exe" loaded module "KERNEL32" at base 74260000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72900000 "powershell.exe" loaded module "KERNEL32.DLL" at base 74260000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75aa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72200000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 74ef0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 77240000 "powershell.exe" loaded module "VERSION.DLL" at base 73b60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71a50000 "powershell.exe" loaded module "USER32.DLL" at base 77080000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75260000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 72290000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 744f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70570000 "powershell.exe" loaded module "RPCRT4.DLL" at base 73ea0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 74160000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 744f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 740b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 70540000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74050000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75260000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 704b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6fa50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f230000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 744f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 744f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77410000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 75b20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 75d30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 73e50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6eab0000 "powershell.exe" loaded module "AMSI.DLL" at base 6eaa0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 73e50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 750d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73b60000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6ea80000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\A4X11NRG.DLL" at base 6ea40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6e9a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 750d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6e640000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 744f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6e5f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6e4e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6e4d0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73e30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 6e4b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738e0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6e410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 74260000 "powershell.exe" loaded module "USERENV.DLL" at base 728d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75aa0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6e3b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6e390000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74260000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6e360000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6e200000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6e1d0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6e1d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 73720000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75260000 "powershell.exe" loaded module "MSISO.DLL" at base 72a30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6e110000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 72ce0000 "powershell.exe" loaded module "AMSI.DLL" at base 6ea80000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6ea60000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\A4X11NRG.DLL" at base 6ea20000 "powershell.exe" loaded module "OLEAUT32" at base 740b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.IBAAE5ED9#\D7574833D2797C3E1BBD2EBC33911C6A\MICROSOFT.IIS.POWERSHELL.COMMANDS.NI.DLL" at base 6dde0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.KD58820A5#\73C2C8627FEE7863C44684EF9B2F3A21\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.NI.DLL" at base 6ddc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.DLL" at base 0 "Morteris.exe" loaded module "KERNEL32" at base 7ff83b7c0000 "Morteris.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff83b2b0000 "Morteris.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff83b2b0000 "Morteris.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff83b2b0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff83b780000 "Morteris.exe" loaded module "KERNEL32.DLL" at base 7ff83b7c0000 "Morteris.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff83b2b0000 "Morteris.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff83b2b0000 "Morteris.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff83b2b0000 "Morteris.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff830460000 "Morteris.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff83b2b0000 "Morteris.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff83b230000 "Morteris.exe" loaded module "POWRPROF.DLL" at base 7ff83a600000 "Morteris.exe" loaded module "USER32.DLL" at base 7ff83da40000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff838c40000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff839e90000 "Morteris.exe" loaded module "SHELL32.DLL" at base 1f9df5c0000 "Morteris.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ff83dd40000 "Morteris.exe" loaded module "ADVAPI32.DLL" at base 7ff83e1c0000 "Morteris.exe" loaded module "KBDUS.DLL" at base 7ff825810000 "Morteris.exe" loaded module "API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL" at base 7ff83dd40000 "Morteris.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff83ce80000 "Morteris.exe" loaded module "OLE32.DLL" at base 7ff83d750000 "Morteris.exe" loaded module "OLEAUT32.DLL" at base 7ff83dc70000 "Morteris.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff83a690000 "Morteris.exe" loaded module "NTDLL.DLL" at base 7ff83e2b0000 "Morteris.exe" loaded module "COMCTL32.DLL" at base 7ff82a030000 "Morteris.exe" loaded module "RPCRT4.DLL" at base 7ff83d8a0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ff8364d0000 "Morteris.exe" loaded module "IPHLPAPI.DLL" at base 7ff839bc0000 "Morteris.exe" loaded module "GDI32.DLL" at base 7ff83e0b0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff83b870000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff83d750000 "Morteris.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff83ce80000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ff82c440000 "Morteris.exe" loaded module "WTSAPI32.DLL" at base 7ff836660000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ff834950000 "Morteris.exe" loaded module "MSCMS.DLL" at base 7ff826bd0000 "Morteris.exe" loaded module "CFGMGR32.DLL" at base 7ff83b1e0000 "Morteris.exe" loaded module "API-MS-WIN-POWER-BASE-L1-1-0.DLL" at base 7ff83a600000 "Morteris.exe" loaded module "\\?\%LOCALAPPDATA%\PROGRAMS\MORTERIS\RESOURCES\APP.ASAR.UNPACKED\NODE_MODULES\SQLITE3\LIB\BINDING\NAPI-V6-WIN32-UNKNOWN-X64\NODE_SQLITE3.NODE" at base 7ff819e20000 "Morteris.exe" loaded module "\\?\%LOCALAPPDATA%\PROGRAMS\MORTERIS\RESOURCES\APP.ASAR.UNPACKED\NODE_MODULES\@PRIMNO\DPAPI\PREBUILDS\WIN32-X64\@PRIMNO+DPAPI.NODE" at base 7ff8334e0000 "Morteris.exe" loaded module "\\?\%LOCALAPPDATA%\PROGRAMS\MORTERIS\RESOURCES\APP.ASAR.UNPACKED\NODE_MODULES\KOFFI\BUILD\KOFFI\WIN32_X64\KOFFI.NODE" at base 7ff817840000 "Morteris.exe" loaded module "BCRYPTPRIMITIVES" at base 7ff83b230000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff8320e0000 "Morteris.exe" loaded module "WINHTTP.DLL" at base 7ff836e40000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff839a40000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff833540000 "Morteris.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ff83b2b0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 7ff8295f0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\XMLLITE.DLL" at base 7ff836730000 "Morteris.exe" loaded module "ATLTHUNK.DLL" at base 7ff81ce00000 "Morteris.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff83da40000 "Morteris.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff83da40000 "Morteris.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ff83ce80000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff835060000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 7ff8271c0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 7ff813f00000 "Morteris.exe" loaded module "SECUR32.DLL" at base 7ff8309e0000 "Morteris.exe" loaded module "SSPICLI.DLL" at base 7ff83a500000 "Morteris.exe" loaded module "MLANG.DLL" at base 7ff8306d0000 "Morteris.exe" loaded module "PROPSYS.DLL" at base 7ff836c80000 "Morteris.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 7ff83dd40000 "Morteris.exe" loaded module "WININET.DLL" at base 7ff829c50000 "Morteris.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 7ff83ce80000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff836c80000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff83a760000 "Morteris.exe" loaded module "SHELL32.DLL" at base 1eae53b0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\DXCORE.DLL" at base 0 "Morteris.exe" loaded module "DXGI.DLL" at base 7ff839470000 "Morteris.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7ff838fc0000 "Morteris.exe" loaded module "%WINDIR%\SYSTEM32\MF.DLL" at base 7ff828250000 "Morteris.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\MORTERIS\D3DCOMPILER_47.DLL" at base 7ff8173b0000 "Morteris.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\MORTERIS\LIBGLESV2.DLL" at base 7ff80dbb0000 "Morteris.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\MORTERIS\LIBEGL.DLL" at base 7ff8281c0000 "Morteris.exe" loaded module "DWMAPI.DLL" at base 7ff838eb0000 "Morteris.exe" loaded module "D3D11.DLL" at base 7ff837ad0000 "Morteris.exe" loaded module "DCOMP.DLL" at base 7ff838460000 "Morteris.exe" loaded module "D3D10WARP.DLL" at base 7ff833c50000 "Morteris.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\MORTERIS\VK_SWIFTSHADER.DLL" at base 7ff80d630000 "Morteris.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\MORTERIS\DXIL.DLL" at base 7ff819ca0000 "Morteris.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\MORTERIS\DXCOMPILER.DLL" at base 7ff80bda0000 "Morteris.exe" loaded module "SHELL32.DLL" at base 221deb500003d:T987,"Morteris.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Morteris.exe" was detected as "Microsoft Linker" and name: "Linker" "d3dcompiler_47.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "d3dcompiler_47.dll" was detected as "Microsoft Linker" and name: "Linker" "ffmpeg.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ffmpeg.dll" was detected as "Microsoft Linker" and name: "Linker" "dxil.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "dxil.dll" was detected as "Microsoft Linker" and name: "Linker" "vulkan-1.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "vulkan-1.dll" was detected as "Microsoft Linker" and name: "Linker" "libEGL.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libEGL.dll" was detected as "Microsoft Linker" and name: "Linker" "nsis7z.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "nsis7z.dll" was detected as "Microsoft Linker" and name: "Linker" "elevate.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "elevate.exe" was detected as "Microsoft Linker" and name: "Linker" "StdUtils.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "StdUtils.dll" was detected as "Microsoft Linker" and name: "Linker" "System.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "System.dll" was detected as "Microsoft Linker" and name: "Linker" "SpiderBanner.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "SpiderBanner.dll" was detected as "Microsoft Linker" and name: "Linker" "nsExec.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "nsExec.dll" was detected as "Microsoft Linker" and name: "Linker" "WinShell.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "WinShell.dll" was detected as "Microsoft Linker" and name: "Linker" "koffi.node" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "koffi.node" was detected as "Microsoft Linker" and name: "Linker" "node_sqlite3.node" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "node_sqlite3.node" was detected as "Microsoft Linker" and name: "Linker"3e:T101d,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "split-path $_.Path" (Indicator: "Split-Path"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string ",(new-object Microsoft.Powershell.Commands.EnhancedKeyUsageProperty -argumentlist $this).EnhancedKeyUsageList;" (Indicator: "New-Object"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string ",(new-object Microsoft.Powershell.Commands.DnsNameProperty -argumentlist $this).DnsNameList;" (Indicator: "New-Object"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "New-Object System.Version -ArgumentList @(" (Indicator: "New-Object"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "new-object datetime @([int]$matches[1], [int]$matches[2], [int]$matches[3])" (Indicator: "New-Object"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "$argumentsBuilder = new-object System.Text.StringBuilder" (Indicator: "New-Object"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "$private:sd = new-object System.Security.AccessControl.CommonSecurityDescriptor $false,$false,$this.SecurityDescriptorSddl" (Indicator: "New-Object"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "split-path $_.Path -leaf" (Indicator: "Split-Path"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp")3f:Tf3b,"Morteris.exe" touched "Ptype_PSFactory" (Path: "HKCU\WOW6432NODE\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS") "Morteris.exe" touched "Application Registration" (Path: "HKCU\WOW6432NODE\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "Morteris.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "Morteris.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Morteris.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "Morteris.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Morteris.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "Morteris.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "Morteris.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "Morteris.exe" touched "IPropertyStore Handler for Images" (Path: "HKCU\WOW6432NODE\CLSID\{A38B883C-1682-497E-97B0-0A3A9E801682}\OVERRIDEFILESYSTEMPROPERTIES") "Morteris.exe" touched "Shell Copy Hook" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\INPROCSERVER32") "Morteris.exe" touched "Shell extensions for sharing" (Path: "HKCU\WOW6432NODE\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\INSTANCE") "Morteris.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "Morteris.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "Morteris.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "Morteris.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "Morteris.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "Morteris.exe" touched "Property Store over folder final" (Path: "HKCU\WOW6432NODE\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "Morteris.exe" touched "ShellWindows" (Path: "HKCU\WOW6432NODE\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\TREATAS") "Morteris.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "Morteris.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "Morteris.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "Morteris.exe" touched "Microsoft Url History Service" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}") "Morteris.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\TREATAS") "Morteris.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "Morteris.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "Morteris.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "Morteris.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\TREATAS") "Morteris.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS")40:T71d,Process "powershell.exe" (UID: 00000000-00001964) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "powershell.exe" (UID: 00000000-00001964) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "Morteris.exe" (UID: 00000000-00002200) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles, NUMBER_OF_PROCESSORS" Process "Morteris.exe" (UID: 00000000-00002200) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432" Process "Morteris.exe" (UID: 00000000-00006604) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00000584) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00000584) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00005300) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_584_AKHCMUSYGLIBDODM", EDGE_BROWSER_PID="584"" Process "msedge.exe" (UID: 00000000-00002032) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="28", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00006688) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00006688) was launched with modified environment variables: "EDGE_METRICS_SESSION_ID"41:Td1c,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00006012-00000C2B-3368861713] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00006012-00000C2B-3368889494] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00006012-00000C2B-3368925020] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00006012-00000C2B-3369006119] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00006012-00000C2B-3369037402] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00006012-00000C2B-3369065183] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00006012-00000C2B-3369090919] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00006012-00000C2B-3369121679] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00006012-00000C2B-3369148741] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00006012-00000C2B-3369176773] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00006012-00000C2B-3369204305] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00006012-00000C2B-3369232061] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00006012-00000C2B-3370260627] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001964-00000C2E-900640266] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001964-00000C2B-3371792785] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001964-00000C2B-3371893466] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001964-00000C2B-3371951815] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001964-00000C2B-3372107336] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001964-00000C2B-3372161517] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001964-00000C2B-3372211870] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001964-00000C2B-3372270464] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001964-00000C2B-3372447997] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001964-00000C2B-3372477166] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001964-00000C2B-3372709797] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001964-00000C2B-3372743186]42:Tb58,Spawned process "powershell.exe" with commandline "-C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinu ..." (UID: 00000000-00001964) Spawned process "powershell.exe" with commandline "-C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { ..." (UID: 00000000-00007036), Spawned process "Morteris.exe" (UID: 00000000-00002200), Spawned process "Morteris.exe" with commandline ""%APPDATA%\\Morteris" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAA ..." (UID: 00000000-00006604), Spawned process "Morteris.exe" with commandline ""%APPDATA%\\Morteris" --field-trial-handle=1548 i 52935284211392 ..." (UID: 00000000-00001460), Spawned process "msedge.exe" with commandline "--single-argument https://www.drivereasy.com/" (UID: 00000000-00000584), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005300) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00002032) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006688) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003640) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006488) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00005528) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00006040) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00007008) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00007292) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003024) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00003776) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00003572) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00007608) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002004) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007968)43:Tb58,Spawned process "powershell.exe" with commandline "-C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinu ..." (UID: 00000000-00001964) Spawned process "powershell.exe" with commandline "-C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { ..." (UID: 00000000-00007036), Spawned process "Morteris.exe" (UID: 00000000-00002200), Spawned process "Morteris.exe" with commandline ""%APPDATA%\\Morteris" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAA ..." (UID: 00000000-00006604), Spawned process "Morteris.exe" with commandline ""%APPDATA%\\Morteris" --field-trial-handle=1548 i 52935284211392 ..." (UID: 00000000-00001460), Spawned process "msedge.exe" with commandline "--single-argument https://www.drivereasy.com/" (UID: 00000000-00000584), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005300) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00002032) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006688) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003640) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006488) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00005528) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00006040) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00007008) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00007292) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003024) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00003776) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00003572) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00007608) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002004) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007968)44:Tc63,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 10:7A:FA:65:99:36:14:9C:AE:9A:3A:56:ED:1A:5E:1D:62:4C:5F:36; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 90:63:5B:84:92:4E:D7:7C:97:87:A7:B7:CD:FA:48:F4:90:7F:AB:2F; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 31:A8:B5:C1:CD:F5:51:78:A9:8C:E3:B4:73:92:CF:C0:6D:69:48:19; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: EC:73:40:3C:26:8F:31:40:84:B3:D4:50:0A:BD:24:AF:31:5B:C1:62; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 1F:FF:24:FD:70:38:B9:32:CA:47:7C:A6:B0:64:A7:67:6A:8E:B8:77; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert G5 TLS RSA4096 SHA384 2021 CA1, O="DigiCert Inc.", C=US" (SHA1: 8E:FC:73:27:DC:12:04:21:B5:E1:6B:97:92:E5:92:17:32:26:69:35; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert TLS RSA4096 Root G5, O="DigiCert Inc.", C=US" (SHA1: 81:5C:D8:FF:64:BE:AC:E0:7E:F8:F2:F9:D5:33:01:1F:A4:79:36:58; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert TLS RSA4096 Root G5, O="DigiCert Inc.", C=US" (SHA1: A7:88:49:DC:5D:7C:75:8C:8C:DE:39:98:56:B3:AA:D0:B2:A5:71:35; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B6:91:EE:DE:41:05:EE:9E:F8:25:BF:21:3F:C1:A4:70:63:18:44:1E; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A8:98:5D:3A:65:E5:E5:C4:B2:D7:D6:6D:40:C6:DD:2F:B1:9C:54:36; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 5F:99:6E:26:2A:3A:DA:FF:7F:0D:EE:C5:8B:2A:01:AE:28:26:AD:C4; see report for more information)45:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp")46:T2eff,"vk_swiftshader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\vk_swiftshader.dll]- [targetUID: 00000000-00006604] "Morteris.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 14 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\Morteris.exe]- [targetUID: 00000000-00006604] "installer.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%LOCALAPPDATA%\morteris-updater\installer.exe]- [targetUID: 00000000-00006012] "libGLESv2.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\libGLESv2.dll]- [targetUID: 00000000-00006604] "dxcompiler.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\Programs\Morteris\dxcompiler.dll]- [targetUID: 00000000-00006604] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\d3dcompiler_47.dll]- [targetUID: 00000000-00006604] "ffmpeg.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\ffmpeg.dll]- [targetUID: 00000000-00006012] "dxil.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\dxil.dll]- [targetUID: 00000000-00006604] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\vulkan-1.dll]- [targetUID: 00000000-00006012] "libEGL.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\libEGL.dll]- [targetUID: 00000000-00006604] "nsis7z.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsgE14.tmp\nsis7z.dll]- [targetUID: 00000000-00006012] "Uninstall Morteris.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%LOCALAPPDATA%\Programs\Morteris\Uninstall Morteris.exe]- [targetUID: 00000000-00006012] "elevate.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\elevate.exe]- [targetUID: 00000000-00006012] "StdUtils.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsgE14.tmp\StdUtils.dll]- [targetUID: 00000000-00006012] "urlref_httpswww.drivereasy.com" has type "HTML document Unicode text UTF-8 text with very long lines (8856) with CRLF LF line terminators"- [targetUID: N/A] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsgE14.tmp\System.dll]- [targetUID: 00000000-00001964] "SpiderBanner.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsgE14.tmp\SpiderBanner.dll]- [targetUID: 00000000-00006012] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsgE14.tmp\nsExec.dll]- [targetUID: 00000000-00006012] "WinShell.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\nsgE14.tmp\WinShell.dll]- [targetUID: 00000000-00006012] "Morteris.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Programs\Morteris\Morteris.exe" MachineID a0eylqtclgodr0i KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Sun Mar 29 14:07:14 2026 atime=Sun Mar 29 14:07:14 2026 mtime=Fri Mar 20 13:24:14 2026 length=222860800 window=normal IDListSize 0x0228 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Programs\Morteris\Morteris.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Morteris.lnk]- [targetUID: 00000000-00006012] "Morteris.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Programs\Morteris\Morteris.exe" MachineID a0eylqtclgodr0i KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Sun Mar 29 14:07:14 2026 atime=Sun Mar 29 14:07:14 2026 mtime=Fri Mar 20 13:24:14 2026 length=222860800 window=normal IDListSize 0x0228 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Programs\Morteris\Morteris.exe""- Location: [%USERPROFILE%\Desktop\Morteris.lnk]- [targetUID: 00000000-00006012] "koffi.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked missing section headers at 5360208"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\koffi\build\koffi\musl_x64\koffi.node]- [targetUID: 00000000-00006012] "koffi.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (FreeBSD) dynamically linked missing section headers at 5613528"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\freebsd_x64\koffi.node]- [targetUID: 00000000-00006012] "koffi.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked missing section headers at 5541096"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_x64\koffi.node]- [targetUID: 00000000-00006012] "koffi.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked missing section headers at 5616584"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\openbsd_x64\koffi.node]- [targetUID: 00000000-00006012] "LICENSES.chromium.html" has type "HTML document text HTML document ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Morteris\LICENSES.chromium.html]- [targetUID: 00000000-00006012] "app-64.7z" has type "7-zip archive data version 0.4"- Location: [%TEMP%\nsgE14.tmp\app-64.7z]- [targetUID: 00000000-00006012] "koffi.node" has type "ELF 32-bit LSB shared object Intel i386 version 1 (SYSV) dynamically linked for OpenBSD with debug_info not stripped"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\koffi\build\koffi\openbsd_ia32\koffi.node]- [targetUID: 00000000-00006012] "koffi.node" has type "ELF 32-bit LSB shared object Intel i386 version 1 (FreeBSD) dynamically linked for FreeBSD 13.0 (1300139) with debug_info not stripped"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\freebsd_ia32\koffi.node]- [targetUID: 00000000-00006012] "koffi.node" has type "ELF 32-bit LSB shared object Intel i386 version 1 (GNU/Linux) dynamically linked BuildID[sha1]=46596bf2e5346a3e23eea566a1281e8ebb721523 not stripped"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_ia32\koffi.node]- [targetUID: 00000000-00006012] "koffi.node" has type "Mach-O 64-bit x86_64 dynamically linked shared library flags:"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\koffi\build\koffi\darwin_x64\koffi.node]- [targetUID: 00000000-00006012] "koffi.node" has type "Mach-O 64-bit arm64 dynamically linked shared library flags:"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\koffi\build\koffi\darwin_arm64\koffi.node]- [targetUID: 00000000-00006012] "sqlite-autoconf-3410100.tar.gz" has type "gzip compressed data from Unix original size modulo 2^32 12308480"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite-autoconf-3410100.tar.gz]- [targetUID: 00000000-00006012] "koffi.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_x64\koffi.node]- [targetUID: 00000000-00006012] "koffi.node" has type "PE32+ executable for MS Windows 6.02 (DLL) ARM64 6 sections"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_arm64\koffi.node]- [targetUID: 00000000-00006012] "node_sqlite3.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\sqlite3\lib\binding\napi-v6-win32-unknown-x64\node_sqlite3.node]- [targetUID: 00000000-00006012] "koffi.node" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_ia32\koffi.node]- [targetUID: 00000000-00006012] "sqlite3.js" has type "JavaScript source ASCII text"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3.js]- [targetUID: 00000000-00006012] "benchmarks.md" has type "HTML document Unicode text UTF-8 text"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\benchmarks.md]- [targetUID: 00000000-00006012] "index.html" has type "HTML document ASCII text"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\examples\nwjs\src\index.html]- [targetUID: 00000000-00006012] "index.html" has type "HTML document ASCII text"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\examples\electron-forge\src\index.html]- [targetUID: 00000000-00006012] "index.md" has type "HTML document Unicode text UTF-8 text"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\index.md]- [targetUID: 00000000-00006012] "sqlite3.gyp" has type "ASCII text"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite3.gyp]- [targetUID: 00000000-00006012] "mimetypes_gen.py" has type "Python script Unicode text UTF-8 text executable"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\core\base\mimetypes_gen.py]- [targetUID: 00000000-00006012] "platforms.md" has type "HTML document Unicode text UTF-8 text"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\platforms.md]- [targetUID: 00000000-00006012] "code.html" has type "HTML document Unicode text UTF-8 text"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\koffi\doc\templates\code.html]- [targetUID: 00000000-00006012] "page.html" has type "HTML document Unicode text UTF-8 text"- Location: [%LOCALAPPDATA%\Programs\Morteris\resources\app.asar.unpacked\node_modules\koffi\doc\templates\page.html]- [targetUID: 00000000-00006012] "sqlite3.cmake" has type "Unicode text UTF-8 text"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\cmake\sqlite3.cmake]- [targetUID: 00000000-00006012] "common-sqlite.gypi" has type "ASCII text"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\common-sqlite.gypi]- [targetUID: 00000000-00006012] "develop.sh" has type "Bourne-Again shell script ASCII text executable"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\develop.sh]- [targetUID: 00000000-00006012] "sqlite3-binding.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\nsgE14.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3-binding.js]- [targetUID: 00000000-00006012]47:T9ec,"Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Morteris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")48:T95b,"vk_swiftshader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\vk_swiftshader.dll]- [targetUID: 00000000-00006604] "libGLESv2.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\libGLESv2.dll]- [targetUID: 00000000-00006604] "dxcompiler.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\Programs\Morteris\dxcompiler.dll]- [targetUID: 00000000-00006604] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\d3dcompiler_47.dll]- [targetUID: 00000000-00006604] "ffmpeg.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\ffmpeg.dll]- [targetUID: 00000000-00006012] "dxil.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\dxil.dll]- [targetUID: 00000000-00006604] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\vulkan-1.dll]- [targetUID: 00000000-00006012] "libEGL.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsgE14.tmp\7z-out\libEGL.dll]- [targetUID: 00000000-00006604] "nsis7z.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsgE14.tmp\nsis7z.dll]- [targetUID: 00000000-00006012] "StdUtils.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsgE14.tmp\StdUtils.dll]- [targetUID: 00000000-00006012] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsgE14.tmp\System.dll]- [targetUID: 00000000-00001964] "SpiderBanner.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsgE14.tmp\SpiderBanner.dll]- [targetUID: 00000000-00006012] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsgE14.tmp\nsExec.dll]- [targetUID: 00000000-00006012] "WinShell.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\nsgE14.tmp\WinShell.dll]- [targetUID: 00000000-00006012]49:Te69,"Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "Morteris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")4a:Ta4d,"Morteris.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Morteris.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Morteris.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Morteris.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "Morteris.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "Morteris.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsgE14.tmp\SYSTEM.DLL" "Morteris.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsgE14.tmp\System.dll" "Morteris.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsgE14.tmp\STDUTILS.DLL" "Morteris.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsgE14.tmp\StdUtils.dll" "Morteris.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsgE14.tmp\SpiderBanner.dll" "Morteris.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsgE14.tmp\nsExec.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll"4b:Taae,"Morteris.exe" trying to access non-existent file "C:\MORTERIS.EXE.LOCAL" "Morteris.exe" trying to access non-existent file "C:\Morteris.exe.Local\" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POWERSHELL.EXE.LOG" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\MICROSOFT.PB378EC07#" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\MICROSOFT.POWERSHELL.CONSOLEHOST.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.INI" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.MANAA57FC8CC#" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\SYSTEM.MANAGEMENT.AUTOMATION.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.INI" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PSREADLINE" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PSReadline" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.INI"4c:T485,Found http requests in header "GET /tag/uet/187121999" Found http requests in header "POST /collect" Found http requests in header "GET /" Found http requests in header "GET /client_data/7591959b80b1d888fb0b70b8/script.js" Found http requests in header "POST /api/v1/log" Found http requests in header "GET /client_data/7591959b80b1d888fb0b70b8/t8lQuOSf.json" Found http requests in header "GET /api/v1/ip" Found http requests in header "POST /ccm/collect?frm=0&ae=g&en=page_view&dl=https%3A%2F%2Fwww.drivereasy.com%2F&scrsrc=www.googletagmanager.com&rnd=699585923.1774793298&dt=Driver%20Easy%20%C2%AE%20%7C%20Windows%20Driver%20Updater&auid=1447502952.1774793298&navt=n&npa=0&ep.ads_data_redaction=0&gdid=dY2Q2ZW&_tu=CA>m=45He63q0h2v892962275za200zd892962275xea&gcs=G111&gcd=13v3v3v3v5l1&dma=0&tag_exp=0~115616986~115938466~115938468~117384405~117484252&apve=1&apvf=f&apvc=1&tft=1774793298280&tfd=4378" Found http requests in header "GET /c.gif" Found http requests in header "GET /0.8.57/clarity.js" Found http requests in header "GET /iframe_api" Found http requests in header "GET /s/roboto/v48/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2"4d:Tcde,Found reference to API "GetHostNameW" (Indicator: "gethostname"; Source: "00000000-00002200-00000C2C-3428183015") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 day and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") Found reference to API "other {This device will be saved for {DAYS} days and you can connect without a code next time. This is set by your administrator.}}{HOURS, plural," (Indicator: " connect "; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 hour and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") Found reference to API "other {This device will be saved for {HOURS} hours and you can connect without a code next time. This is set by your administrator.}}{MONTHS, plural," (Indicator: " connect "; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 month and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") Found reference to API "other {This device will be saved for {MONTHS} months and you can connect without a code next time. This is set by your administrator.}}{YEARS, plural," (Indicator: " connect "; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 year and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") file/memory contains long string with (Indicator: " bind "; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") Found reference to API "USB device from $2 (product $1)USB devices from $1USB device ($2:$1)USB devices from vendor $1Any serial port$1 wants to connect to a HID deviceUnknown Device ($1)Finding HID devices" (Indicator: " connect "; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") Found reference to API "t use a secure connection this time. An attacker might be trying to eavesdrop or modify your network connection. $1You usually connect to sites securely, but Chrome couldn" (Indicator: " connect "; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00001964.00000000.281613.03480000.00000004.mdmp, 00000000-00001964.00000001.282006.03480000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00001964.00000000.281613.03480000.00000004.mdmp, 00000000-00001964.00000001.282006.034F9000.00000004.mdmp")4e:T476,"2.5.29.37" "2.5.29.35" Potential IP "127.0.0.1" found in string "activate inspector on host:port (default: 127.0.0.1:9229)" "9.7.8.0" Potential IP "127.0.0.1" found in string "?or on host:port (default: 127.0.0.1:9229)" Potential IP "127.0.0.1" found in string "or on host:port (default: 127.0.0.1:9229)" "92.168.0.1" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" "2.5.29.17" "2.5.29.15" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.14" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.32" "2.5.29.19" "2.5.29.31" "3.0.0.0" "1.1.0.1" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "4.0.0.0" found in string "ystem.Configuration,4.0.0.0,,b03f5f7f11d50a3a" "2.5.4.3" "2.5.29.1" "2.5.29.10" "1.3.6.1" "2.5.29.16" "2.5.4.8" "2.5.4.7" "2.5.4.10" "2.5.4.11" "2.5.4.6" "2.5.4.5"4f:T25db,Pattern match: "www.drivereasy.com" Pattern match: "https://www.drivereasy.com/" Heuristic match: "r).ir" Heuristic match: "/&.ee" Heuristic match: "% .tz" Heuristic match: "lie.qa" Pattern match: "c.fa/|4" Heuristic match: "_|t.ai" Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "https://www.raylib.com/" Pattern match: "https://buymeacoffee.com/koromix" Pattern match: "https://github.com/jshttp/mime-db#" Pattern match: "https://nodejs.org/" Pattern match: "https://www.npmjs.com/package/koffi" Pattern match: "www.clarity.ms" Pattern match: "www.clarity.msconnection" Heuristic match: "y.clarity.ms" Pattern match: "https://www.drivereasy.comsec-fetch-site" Heuristic match: "cdn-cookieyes.com" Heuristic match: "log.cookieyes.com" Heuristic match: "directory.cookieyes.com" Pattern match: "www.google.com" Pattern match: "www.googletagmanager.com&rnd=699585923.1774793298&dt=driver%20easy%20%c2%ae%20%7c%20windows%20driver%20updater&auid=1447502952.1774793298&navt=n&npa=0&ep.ads_data_redaction=0&gdid=dy2q2zw&_tu=ca>m=45he63q0h2v892962275za200zd892962275xea&gcs=g111&gcd=13v3" Heuristic match: "c.clarity.ms" Heuristic match: "scripts.clarity.ms" Pattern match: "www.youtube.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "i.ytimg.com" Heuristic match: "googleads.g.doubleclick.net" Heuristic match: "static.doubleclick.net" Heuristic match: "jnn-pa.googleapis.com" Pattern match: "google.internal.waa.v1.waa/generateit" Heuristic match: "images.drivereasy.com" Heuristic match: "s.w.org" Heuristic match: "s.ytimg.com" Heuristic match: "youtube.com" Heuristic match: "yt3.ggpht.com" Heuristic match: "\\?\%localappdata%\programs\morteris\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_x64\koffi.no" Pattern match: "https://nodejs.org/download/release/v24.14.0/win-x64/node.lib" Pattern match: "https://nodejs.org/download/release/v24.14.0/node-v24.14.0.tar.gz" Pattern match: "https://nodejs.org/download/release/v24.14.0/node-v24.14.0-headers.tar.gz" Heuristic match: "blink.net" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "ext=.com" Pattern match: "chrome.google.com/webstore?hl=enctrlpress" Pattern match: "https://myactivity.google.com/" Pattern match: "https://policies.google.com/" Pattern match: "https://safebrowsing.google.com/" Pattern match: "https://support.google.com/chromebook?p=app_intent" Pattern match: "myactivity.google.com/product/gemini?utm_source=geminimanage" Pattern match: "https://safebrowsing.google.com/safebrowsing/report_error/" Heuristic match: "[*.]google.com" Pattern match: "https://chrome.google.com/webstore/category/extensions" Pattern match: "https://www.example.comurl" Pattern match: "https://support.google.com/chrome/?p=passkeys" Pattern match: "www.google.com/chrome/privacy/eula_text.htmlh&elpprofile" Pattern match: "measurementlab.net/privacy" Pattern match: "https://chromeenterprise.google/policies/#browserswitcherenabled" Pattern match: "https://chromeenterprise.google/policies/#browserswitcherexternalsitelisturl" Pattern match: "https://chromeenterprise.google/policies/#browserswitcheruseiesitelist" Pattern match: "https://chromeenterprise.google/policies/#browserswitcherurlgreylist" Pattern match: "https://chromestatus.com/features#browsers.chrome.status%3a%22deprecated%22" Pattern match: "https://support.google.com/chrome/a/?p=browser_profile_details" Pattern match: "http://example.com" Pattern match: "https://support.google.com/chrome/answer/6098869" Heuristic match: "t support a secure connectionattackers can see and change information you send or receive from the site.it" Heuristic match: "string.prototype.at" Heuristic match: "%typedarray%.prototype.at" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Heuristic match: "ntrust.net" Pattern match: "www.digicert.com1" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://www.microsoft.com0" Heuristic match: "microsoft.powershell.co" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.security/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.security.dll" Heuristic match: "$this.userinfo.identity.name" Heuristic match: "$this.userinfo.windowsidentity.name" Heuristic match: "$_.subjectname.name" Heuristic match: "$_.issuername.name" Heuristic match: "$this.resolvedcommand.name" Heuristic match: "$this.name + -> + $this.resolvedcommand.name" Heuristic match: "$this.name" Heuristic match: "$commandname = $this.name" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "l.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pk" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.validationtest.contoso.com/test%d.html"50:T19f1,GET /tag/uet/187121999 HTTP/1.1 Host: www.clarity.ms Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.drivereasy.com/ Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET / HTTP/2 Host: www.drivereasy.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: navigate Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Sec-Fetch-User: ?1 Accept-Encoding: gzip deflate br Accept: text/html application/xhtml+xml application/xml;q=0.9 image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Dest: document GET /client_data/7591959b80b1d888fb0b70b8/script.js HTTP/2 Host: cdn-cookieyes.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: no-cors Referer: https://www.drivereasy.com/ Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br Accept: */* Sec-Fetch-Dest: script GET /client_data/7591959b80b1d888fb0b70b8/t8lQuOSf.json HTTP/2 Host: cdn-cookieyes.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: cors Referer: https://www.drivereasy.com/ Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Origin: https://www.drivereasy.com Accept-Encoding: gzip deflate br Accept: */* Sec-Fetch-Dest: empty GET /api/v1/ip HTTP/2 Host: directory.cookieyes.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: cors Referer: https://www.drivereasy.com/ Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Origin: https://www.drivereasy.com Accept-Encoding: gzip deflate br Accept: */* Sec-Fetch-Dest: empty GET /c.gif HTTP/2 Host: c.clarity.ms User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: no-cors Referer: https://www.drivereasy.com/ Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Dest: image GET /0.8.57/clarity.js HTTP/2 Host: scripts.clarity.ms User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: no-cors Referer: https://www.drivereasy.com/ Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br Accept: */* Sec-Fetch-Dest: script GET /iframe_api HTTP/2 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: no-cors Referer: https://www.drivereasy.com/ Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br Accept: */* Sec-Fetch-Dest: script GET /s/roboto/v48/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/2 Host: fonts.gstatic.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: cors Referer: https://www.youtube.com/ Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Origin: https://www.youtube.com Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br Accept: */* Sec-Fetch-Dest: font GET /vi_webp/j4Gd-9d4Enc/maxresdefault.webp HTTP/2 Host: i.ytimg.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: no-cors Referer: https://www.youtube.com/ Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Dest: image GET /pagead/id HTTP/2 Host: googleads.g.doubleclick.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: cors Referer: https://www.youtube.com/ Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Origin: https://www.youtube.com Accept-Encoding: gzip deflate br Accept: */* Sec-Fetch-Dest: empty GET /instream/ad_status.js HTTP/2 Host: static.doubleclick.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Sec-Fetch-Mode: no-cors Referer: https://www.youtube.com/ Sec-Ch-Ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br Accept: */* Sec-Fetch-Dest: script 51:Tbe7,Contains base62 string in header "WebKitFormBoundarydUS0yJzoFrw0nmG" in header "POST /api/v1/log HTTP/2Host: log.cookieyes.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Content-Type: multipart/form-data; boundary=----WebKitFormBoundarydUS0yJzoFrw0nmGMSec-Fetch-Mode: no-corsReferer: https://www.drivereasy.com/Sec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Origin: https://www.drivereasy.comAccept-Encoding: gzip, deflate, brAccept: */*Sec-Fetch-Dest: empty" Contains base62 string in header "7591959b80b1d888fb0b70b8/t8lQuOSf" in header "GET /client_data/7591959b80b1d888fb0b70b8/t8lQuOSf.json HTTP/2Host: cdn-cookieyes.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: corsReferer: https://www.drivereasy.com/Sec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Origin: https://www.drivereasy.comAccept-Encoding: gzip, deflate, brAccept: */*Sec-Fetch-Dest: empty" Contains base62 string in header "45He63q0h2v892962275za200zd892962" in header "POST /ccm/collect?frm=0&ae=g&en=page_view&dl=https%3A%2F%2Fwww.drivereasy.com%2F&scrsrc=www.googletagmanager.com&rnd=699585923.1774793298&dt=Driver%20Easy%20%C2%AE%20%7C%20Windows%20Driver%20Updater&auid=1447502952.1774793298&navt=n&npa=0&ep.ads_data_redaction=0&gdid=dY2Q2ZW&_tu=CA>m=45He63q0h2v892962275za200zd892962275xea&gcs=G111&gcd=13v3v3v3v5l1&dma=0&tag_exp=0~115616986~115938466~115938468~117384405~117484252&apve=1&apvf=f&apvc=1&tft=1774793298280&tfd=4378 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: no-corsReferer: https://www.drivereasy.com/Sec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Sec-Ch-Ua-Platform: "Windows"Origin: https://www.drivereasy.comAccept-Encoding: gzip, deflate, brAccept: */*Sec-Fetch-Dest: empty" Contains base62 string in header "KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa" in header "GET /s/roboto/v48/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/2Host: fonts.gstatic.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Sec-Fetch-Mode: corsReferer: https://www.youtube.com/Sec-Ch-Ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Origin: https://www.youtube.comSec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, brAccept: */*Sec-Fetch-Dest: font"52:T53b,Found HTTPS GET request to https://www.clarity.ms/tag/uet/187121999 Found HTTPS POST request to https://y.clarity.ms/collect Found HTTPS GET request to https://www.drivereasy.com/ Found HTTPS GET request to https://cdn-cookieyes.com/client_data/7591959b80b1d888fb0b70b8/script.js Found HTTPS POST request to https://log.cookieyes.com/api/v1/log Found HTTPS GET request to https://cdn-cookieyes.com/client_data/7591959b80b1d888fb0b70b8/t8lQuOSf.json Found HTTPS GET request to https://directory.cookieyes.com/api/v1/ip Found HTTPS POST request to https://www.google.com/ccm/collect?frm=0&ae=g&en=page_view&dl=https%3A%2F%2Fwww.drivereasy.com%2F&scrsrc=www.googletagmanager.com&rnd=699585923.1774793298&dt=Driver%20Easy%20%C2%AE%20%7C%20Windows%20Driver%20Updater&auid=1447502952.1774793298&navt=n&npa=0&ep.ads_data_redaction=0&gdid=dY2Q2ZW&_tu=CA>m=45He63q0h2v892962275za200zd892962275xea&gcs=G111&gcd=13v3v3v3v5l1&dma=0&tag_exp=0~115616986~115938466~115938468~117384405~117484252&apve=1&apvf=f&apvc=1&tft=1774793298280&tfd=4378 Found HTTPS GET request to https://c.clarity.ms/c.gif Found HTTPS GET request to https://scripts.clarity.ms/0.8.57/clarity.js Found HTTPS GET request to https://www.youtube.com/iframe_api Found HTTPS GET request to https://fonts.gstatic.com/s/roboto/v48/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff253:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp")54:T673,"Morteris.exe" called "FindFirstFileW" with parameter %TEMP%\nsgE14.tmp (UID: 00000000-00006012) "Morteris.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00006012) "Morteris.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006012) "Morteris.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00006012) "Morteris.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00006012) "Morteris.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00006012) "Morteris.exe" called "FindFirstFileW" with parameter %TEMP%\nsgE14.tmp\*.* (UID: 00000000-00006012) "Morteris.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006012) "Morteris.exe" called "FindNextFileW" with parameter 7z-out (UID: 00000000-00006012) "Morteris.exe" called "FindFirstFileW" with parameter %TEMP%\nsgE14.tmp\7z-out (UID: 00000000-00006012) "Morteris.exe" called "FindFirstFileW" with parameter %TEMP%\nsgE14.tmp\7z-out\*.* (UID: 00000000-00006012) "Morteris.exe" called "FindNextFileW" with parameter chrome_100_percent.pak (UID: 00000000-00006012) "Morteris.exe" called "FindNextFileW" with parameter chrome_200_percent.pak (UID: 00000000-00006012) "Morteris.exe" called "FindNextFileW" with parameter d3dcompiler_47.dll (UID: 00000000-00006012) "Morteris.exe" called "FindNextFileW" with parameter dxcompiler.dll (UID: 00000000-00006012) "Morteris.exe" called "FindNextFileW" with parameter dxil.dll (UID: 00000000-00006012) "Morteris.exe" called "FindNextFileW" with parameter ffmpeg.dll (UID: 00000000-00006012)55:T156f,Found string "IAes4i" (Indicator: "aes"; File: "Morteris.exe") file/memory contains long string with (Indicator: "aes"; File: "nsis7z.dll") file/memory contains long string with (Indicator: "aes256"; File: "nsis7z.dll") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00001964.00000001.282006.00191000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; File: "00000000-00001964.00000001.282006.00191000.00000020.mdmp") Found string "&internal/crypto/aes" (Indicator: "aes"; Source: "00000000-00001460.00000000.287576.00064000.00000004.mdmp, 00000000-00001460.00000000.287576.0FBFB000.00000004.mdmp, 00000000-00001460.00000001.287612.00064000.00000004.mdmp") Found string "internal/crypto/chacha20_poly1305" (Indicator: "chacha"; Source: "00000000-00001460.00000000.287576.00088000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") file/memory contains long string with (Indicator: "ecdsa"; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") file/memory contains long string with (Indicator: ".encrypt"; Source: "00000000-00001460.00000000.287576.DC980000.00000002.mdmp") Found string "chacha20_poly1305" (Indicator: "chacha"; Source: "00000000-00001460.00000001.287612.00088000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00001964.00000000.281613.03480000.00000004.mdmp, 00000000-00001964.00000000.281613.0355C000.00000004.mdmp, 00000000-00001964.00000000.281613.07C30000.00000004.mdmp, 00000000-00001964.00000001.282006.03480000.00000004.mdmp, 00000000-00001964.00000001.282006.034F9000.00000004.mdmp, 00000000-00001964.00000001.282006.0355C000.00000004.mdmp, 00000000-00001964.00000001.282006.07C30000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001964.00000000.281613.03480000.00000004.mdmp, 00000000-00001964.00000001.282006.034F9000.00000004.mdmp, 00000000-00001964.00000001.282006.07C30000.00000004.mdmp, 00000000-00001964.00000001.282006.09258000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00001964.00000000.281613.057D0000.00000004.mdmp") Found string "[-WindowStyle