26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample a86d1dc8abd7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a86d1dc8abd7…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a86d1dc8abd7cdd7ce8eb34ee9e739c35ba49d2a4a4c9d62d0da1d2dc14addf1","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","a86d1dc8abd7cdd7ce8eb34ee9e739c35ba49d2a4a4c9d62d0da1d2dc14addf1"],"about":{"@type":"SoftwareApplication","name":"Neue Bestellung.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"a86d1dc8abd7cdd7ce8eb34ee9e739c35ba49d2a4a4c9d62d0da1d2dc14addf1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tbc1,"NeueBestellung.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "SEARCHLIST"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "NAMESERVER"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")28:T154e,"NeueBestellung.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Net.Http\c1f72f0ca85cb675a88efe8f2067f7c8\System.Net.Http.ni.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00006852)29:T3e1d,"NeueBestellung.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006852) "NeueBestellung.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00006852)2a:T43e,"NeueBestellung.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "NeueBestellung.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "NeueBestellung.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "NeueBestellung.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "NeueBestellung.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "NeueBestellung.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "NeueBestellung.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]2b:T160e,"NeueBestellung.exe" loaded module "C:\NeueBestellung.exe" at 00FB0000 "NeueBestellung.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 789D0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77870000 "NeueBestellung.exe" loaded module "%WINDIR%\System32\wow64.dll" at 54690000 "NeueBestellung.exe" loaded module "%WINDIR%\System32\wow64win.dll" at 546F0000 "NeueBestellung.exe" loaded module "%WINDIR%\System32\user32.dll" at 03390000 "NeueBestellung.exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 54680000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\mscoree.dll" at 71CC0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 76D30000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 77590000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\apphelp.dll" at 741E0000 "NeueBestellung.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 72910000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 77460000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 771B0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 74290000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 74280000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74880000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 77820000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 74130000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 769A0000 "NeueBestellung.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 728C0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 76E00000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 74AF0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 76210000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 76240000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 75FC0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 77300000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 774D0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 763A0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 76AC0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 76F80000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 748E0000 "NeueBestellung.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" at 72800000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\shlwapi.dll" at 76940000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\kernel.appcore.dll" at 74910000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\version.dll" at 73CE0000 "NeueBestellung.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" at 72050000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\vcruntime140_clr0400.dll" at 72030000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase_clr0400.dll" at 71F80000 "NeueBestellung.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 708B0000 "NeueBestellung.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" at 71EF0000 "NeueBestellung.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" at 6FE50000 "NeueBestellung.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" at 6F630000 "NeueBestellung.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Net.Http\c1f72f0ca85cb675a88efe8f2067f7c8\System.Net.Http.ni.dll" at 71E60000 "NeueBestellung.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" at 71D50000 "NeueBestellung.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" at 6EEB0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\shell32.dll" at 74B10000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\cfgmgr32.dll" at 74920000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\SHCore.dll" at 77120000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\windows.storage.dll" at 742B0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\powrprof.dll" at 77020000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\profapi.dll" at 76D10000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72BF0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\cryptsp.dll" at 71D30000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\rsaenh.dll" at 6EE80000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\IPHLPAPI.DLL" at 741B0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\dnsapi.dll" at 72B20000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\nsi.dll" at 76190000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\dhcpcsvc6.dll" at 6EE60000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\dhcpcsvc.dll" at 73AE0000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\winnsi.dll" at 73780000 "NeueBestellung.exe" loaded module "%WINDIR%\SysWOW64\psapi.dll" at 76990000 "NeueBestellung.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" at 6ED500002c:T10ff,"NeueBestellung.exe" loaded module "KERNEL32" at base 76d30000 "NeueBestellung.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77590000 "NeueBestellung.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77590000 "NeueBestellung.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77590000 "NeueBestellung.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 748e0000 "NeueBestellung.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77590000 "NeueBestellung.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77590000 "NeueBestellung.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77590000 "NeueBestellung.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728c0000 "NeueBestellung.exe" loaded module "ADVAPI32.DLL" at base 77300000 "NeueBestellung.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72800000 "NeueBestellung.exe" loaded module "SHLWAPI.DLL" at base 76940000 "NeueBestellung.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74910000 "NeueBestellung.exe" loaded module "VERSION.DLL" at base 73ce0000 "NeueBestellung.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72050000 "NeueBestellung.exe" loaded module "USER32.DLL" at base 76e00000 "NeueBestellung.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77590000 "NeueBestellung.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "NeueBestellung.exe" loaded module "MSCOREE.DLL" at base 71cc0000 "NeueBestellung.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76ac0000 "NeueBestellung.exe" loaded module "PSAPI.DLL" at base 76990000 "NeueBestellung.exe" loaded module "RPCRT4.DLL" at base 771b0000 "NeueBestellung.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 708b0000 "NeueBestellung.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "NeueBestellung.exe" loaded module "OLE32.DLL" at base 763a0000 "NeueBestellung.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "NeueBestellung.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77590000 "NeueBestellung.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71ef0000 "NeueBestellung.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6fe50000 "NeueBestellung.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f630000 "NeueBestellung.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NET.HTTP\C1F72F0CA85CB675A88EFE8F2067F7C8\SYSTEM.NET.HTTP.NI.DLL" at base 71e60000 "NeueBestellung.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71d50000 "NeueBestellung.exe" loaded module "KERNEL32.DLL" at base 76d30000 "NeueBestellung.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6eeb0000 "NeueBestellung.exe" loaded module "NTDLL.DLL" at base 77870000 "NeueBestellung.exe" loaded module "SHELL32.DLL" at base 74b10000 "NeueBestellung.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "NeueBestellung.exe" loaded module "BCRYPT.DLL" at base 72bf0000 "NeueBestellung.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6ee80000 "NeueBestellung.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "NeueBestellung.exe" loaded module "IPHLPAPI.DLL" at base 741b0000 "NeueBestellung.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "NeueBestellung.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "NeueBestellung.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6ed500002d:T4c1,"a86d1dc8abd7cdd7ce8eb34ee9e739c35ba49d2a4a4c9d62d0da1d2dc14addf1.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2e:T502,"NeueBestellung.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "NeueBestellung.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "NeueBestellung.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "NeueBestellung.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "NeueBestellung.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "NeueBestellung.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NEUEBESTELLUNG.EXE"; Key: ""; Value: "") "NeueBestellung.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "NeueBestellung.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "NeueBestellung.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "NeueBestellung.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")2f:Tad4,"NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2023"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "")30:Teff,"NeueBestellung.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\FLTLIB.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "NeueBestellung.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\CRYPTSP.dll" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\IPHLPAPI.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\PSAPI.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL.DLL" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL"31:T6fb,"NeueBestellung.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "NeueBestellung.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "NeueBestellung.exe" trying to access non-existent file "C:\NEUEBESTELLUNG.EXE.CONFIG" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "NeueBestellung.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEUEBESTELLUNG.EXE.LOG" "NeueBestellung.exe" trying to access non-existent file "C:\NeueBestellung.exe.config" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\XLFJKA" "NeueBestellung.exe" trying to access non-existent file "C:\NEUEBESTELLUNG.INI" "NeueBestellung.exe" trying to access non-existent file "C:\NeueBestellung.INI" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.PDB" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\SYSTEM.PDB" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.NET.HTTP.PDB" "NeueBestellung.exe" trying to access non-existent file "C:\Windows\SYSTEM.NET.HTTP.PDB" "NeueBestellung.exe" trying to access non-existent file "C:\NEUEBESTELLUNG.PDB" "NeueBestellung.exe" trying to access non-existent file "C:\NeueBestellung.PDB"32:T651,"NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\windows\\temp\\VxOle32.dll"} "NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\IMM32.DLL"} "NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\oleaut32.dll"} "NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\kernelbase.dll"} "NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\ole32.dll"} "NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL.local" "$status": "c0000034"} "NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll"} "NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\VERSION.dll"} "NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll"} "NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VCRUNTIME140_CLR0400.dll" "$status": "c0000034"} "NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\VCRUNTIME140_CLR0400.dll"} "NeueBestellung.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ucrtbase_clr0400.dll" "$status": "c0000034"}33:T822,"NeueBestellung.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00006852) "NeueBestellung.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006852)34:Tbda,"NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "NeueBestellung.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "")35:T16d9,"NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "252" "processHandle": "4294967295" "baseAddress": "3732798" "zeroBits": "0" "commitSize": "0" "viewSize": "299008" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "256" "processHandle": "4294967295" "baseAddress": "373b940" "zeroBits": "0" "commitSize": "0" "viewSize": "1527808" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "260" "processHandle": "4294967295" "baseAddress": "373bb50" "zeroBits": "0" "commitSize": "0" "viewSize": "90112" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "260" "processHandle": "4294967295" "baseAddress": "373bec0" "zeroBits": "0" "commitSize": "0" "viewSize": "139264" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "264" "processHandle": "4294967295" "baseAddress": "373b310" "zeroBits": "0" "commitSize": "0" "viewSize": "1433600" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "268" "processHandle": "4294967295" "baseAddress": "373baa0" "zeroBits": "0" "commitSize": "0" "viewSize": "507904" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "256" "processHandle": "4294967295" "baseAddress": "373bcb0" "zeroBits": "0" "commitSize": "0" "viewSize": "491520" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "260" "processHandle": "4294967295" "baseAddress": "373b260" "zeroBits": "0" "commitSize": "0" "viewSize": "774144" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "256" "processHandle": "4294967295" "baseAddress": "373b890" "zeroBits": "0" "commitSize": "0" "viewSize": "1011712" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "260" "processHandle": "4294967295" "baseAddress": "373b9f0" "zeroBits": "0" "commitSize": "0" "viewSize": "2383872" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "256" "processHandle": "4294967295" "baseAddress": "373bc00" "zeroBits": "0" "commitSize": "0" "viewSize": "602112" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "248" "processHandle": "4294967295" "baseAddress": "373be10" "zeroBits": "0" "commitSize": "0" "viewSize": "151552" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "372" "processHandle": "4294967295" "baseAddress": "135eab0" "zeroBits": "0" "commitSize": "0" "viewSize": "32768" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "388" "processHandle": "4294967295" "baseAddress": "373bd60" "zeroBits": "0" "commitSize": "0" "viewSize": "577536" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "372" "processHandle": "4294967295" "baseAddress": "373b7e0" "zeroBits": "0" "commitSize": "0" "viewSize": "282624" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "420" "processHandle": "4294967295" "baseAddress": "373afa0" "zeroBits": "0" "commitSize": "0" "viewSize": "57344" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\NeueBestellung.exe"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "420" "processHandle": "4294967295" "baseAddress": "373b050" "zeroBits": "0" "commitSize": "0" "viewSize": "32768" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\NeueBestellung.exe"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "432" "processHandle": "4294967295" "baseAddress": "373b100" "zeroBits": "0" "commitSize": "0" "viewSize": "8056832" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "432" "processHandle": "4294967295" "baseAddress": "373b1b0" "zeroBits": "0" "commitSize": "0" "viewSize": "81920" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "NeueBestellung.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "432" "processHandle": "4294967295" "baseAddress": "373b3c0" "zeroBits": "0" "commitSize": "0" "viewSize": "700416" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"}36:Ta5b,"NeueBestellung.exe" wrote bytes "1085ae73802fae73405dae73303eae73d034ae730055ae73b03dae73a039ae731032ae73a035ae73" to virtual address "0x741DC07C" (part of module "IPHLPAPI.DLL") "NeueBestellung.exe" wrote bytes "40d28277300d8377e0f68277c0cd8277" to virtual address "0x748116C4" (part of module "WINDOWS.STORAGE.DLL") "NeueBestellung.exe" wrote bytes "9076b3722044b372e043b672" to virtual address "0x741DC018" (part of module "IPHLPAPI.DLL") "NeueBestellung.exe" wrote bytes "e02a2874f0292874702a2874" to virtual address "0x6EEA700C" (part of module "RSAENH.DLL") "NeueBestellung.exe" wrote bytes "604a1b74106f1b7430a91b74" to virtual address "0x6EE69000" (part of module "DHCPCSVC6.DLL") "NeueBestellung.exe" wrote bytes "20197873501e7873502378731035787300257873" to virtual address "0x741DC054" (part of module "IPHLPAPI.DLL") "NeueBestellung.exe" wrote bytes "1036917420369174" to virtual address "0x76CD01A0" (part of module "COMBASE.DLL") "NeueBestellung.exe" wrote bytes "604a1b74106f1b74" to virtual address "0x73AF1000" (part of module "DHCPCSVC.DLL") "NeueBestellung.exe" wrote bytes "1032897780ec8d77208a8a7700000000" to virtual address "0x74B03000" (part of module "WIN32U.DLL") "NeueBestellung.exe" wrote bytes "d04fc876f0c2b27690c6bb7600cbb276f0f3ba7640ddba7660efba76102db37680a6b27620beb9767042bb76a0beb976c0ffb27640bfb976e058bb76" to virtual address "0x748115B0" (part of module "WINDOWS.STORAGE.DLL") "NeueBestellung.exe" wrote bytes "30ae8974" to virtual address "0x77261094" (part of module "RPCRT4.DLL") "NeueBestellung.exe" wrote bytes "d06e1b74a06d1b7420bd1b7460c21b74e0541b7400571b74c0c41b74f04d1b7430a91b7410e11b7480ae1b74e05a1b74506d1b74b0de1b74d0b91b74" to virtual address "0x72BA3008" (part of module "DNSAPI.DLL") "NeueBestellung.exe" wrote bytes "a092af00b092af00b017010080f00600c0020100b0f0060060b20600e091af00f091af00" to virtual address "0x76E7AC94" (part of module "USER32.DLL") "NeueBestellung.exe" wrote bytes "3014197660151976101e1976a01319767013197690261976d0141976701b1976b01c1976f0171976" to virtual address "0x741DC028" (part of module "IPHLPAPI.DLL") "NeueBestellung.exe" wrote bytes "001fe66e9024e66e" to virtual address "0x741DC0A8" (part of module "IPHLPAPI.DLL") "NeueBestellung.exe" wrote bytes "b07f1577d07f1577b0591977" to virtual address "0x74811778" (part of module "WINDOWS.STORAGE.DLL") "NeueBestellung.exe" wrote bytes "309f2f76f0663276702a2e7620a42f7670232e76003b2f7610602f76b05b2f7600b02f76805b2f76d0812f76d00d2d76" to virtual address "0x7622E018" (part of module "GDI32.DLL") "NeueBestellung.exe" wrote bytes "111912c1" to virtual address "0x7205F798" (part of module "CLR.DLL")37:T700,Found reference to API "SetLastWriteTime" (Indicator: "SetLastWriteTime"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API "SetCreationTime" (Indicator: "SetCreationTime"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API "SetLastAccessTime" (Indicator: "SetLastAccessTime"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp")38:T49d,Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp")39:T4ac,Found reference to API "GetLastWriteTime" (Indicator: "GetLastWriteTime"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API "GetLastAccessTime" (Indicator: "GetLastAccessTime"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp")3a:T7ab,Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp")3b:T839,"NeueBestellung.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")3c:T4e6,"NeueBestellung.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "NeueBestellung.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "NeueBestellung.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")3d:T8cd0,Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "VaultFree"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariable"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileName"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileString"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "VaultGetItem"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformation"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "VaultEnumerateItems"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "VaultCloseVault"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "VaultOpenVault"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "BCryptEncrypt"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameEx"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueEx"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyEx"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "MapVirtualKey"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "BCryptImportKey"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp") Found reference to API (Indicator: "InitializeSecurityContext"; Source: "00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp") Found reference to API (Indicator: "FormatMessage"; Source: "00000000-00002836.00000001.68132.04410000.00000004.mdmp, 00000000-00002836.00000002.70052.04410000.00000004.mdmp, 00000000-00002836.00000003.77480.04410000.00000004.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00002836.00000001.68132.04410000.00000004.mdmp, 00000000-00002836.00000002.70052.04410000.00000004.mdmp, 00000000-00002836.00000003.77480.04410000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "ToAscii"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "MapVirtualKeyEx"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "MoveFileEx"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetUserGeoID"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "CopyFile"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp")3e:Tb8b2,Found URL "http://go.microsoft.coink/?linkid=42127" - Source: "00000000-00002836.00000000.66215.00130000.00000004.mdmp") Found URL "http://blocexpert.eu/.well-known/vvgxgymdka.pngsystem.convert.ctormaxdatasizetracemodesystem.netsystem.net.httplistenersystem.net.socketssystem.net.websocketssystem.net.cachesystem.net.httpsystem.configuration.internal.configurationmanagerinternal," - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/04/xmldsig-more" - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/04/xmlenc" - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://www.w3.org/tr/2001/rec-xml-c14n-20010315system.security.cryptography.xml.xmldsigc14ntransform," - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/10/xml-exc-c14n" - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://www.w3.org/tr/1999/rec-xpath-19991116system.security.cryptography.xml.xmldsigxpathtransform," - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://www.w3.org/tr/1999/rec-xslt-19991116system.security.cryptography.xml.xmldsigxslttransform," - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://www.w3.org/2002/07/decrypt" - Source: "00000000-00002836.00000000.66215.019E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002836.00000001.68132.00130000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00002836.00000001.68132.00130000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigorsadomainvalidationsecureserverca.crt0" - Source: "00000000-00002836.00000001.68132.01870000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0!*.ipify.org" - Source: "00000000-00002836.00000001.68132.01870000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com08f" - Source: "00000000-00002836.00000001.68132.01870000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0or0<0:4http://crl3.digicert.com/digicertcsrsa4096rootg5.crl0a-_97h" - Source: "00000000-00002836.00000001.68132.04410000.00000004.mdmp") Found URL "https://www.newtonsoft.com/json" - Source: "00000000-00002836.00000001.68132.04410000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00002836.00000001.68132.04410000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002836.00000001.68132.04410000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002836.00000001.68132.04410000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigorsadomainvalidationsecureserverca.crt0" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0!*.ipify.org" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com08f" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5oentrust.net1;092www.entrust.net/cps" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!v>gqwv>g79;8kbv>g7v>g4v>guv>gntv>gliv>g" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrussq>g:/pijlf0tq>gimq>gfq>g_q>gpq>g>cth" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt02b" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0?z,:hllej2b,l5s91.3.6.1.4.1.311.10.1201210215646z0/^g(o-cejy" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/use0g;gstertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com08f" - Source: "00000000-00002836.00000001.68132.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0or0<0:4http://crl3.digicert.com/digicertcsrsa4096rootg5.crl0a-_97h" - Source: "00000000-00002836.00000002.70052.04410000.00000004.mdmp") Found URL "https://www.newtonsoft.com/json" - Source: "00000000-00002836.00000002.70052.04410000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00002836.00000002.70052.04410000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002836.00000002.70052.04410000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002836.00000002.70052.04410000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigorsadomainvalidationsecureserverca.crt0" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0!*.ipify.org" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com08f" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5oentrust.net1;092www.entrust.net/cps" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!v>gqwv>g79;8kbv>g7v>g4v>guv>gntv>gliv>g" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrussq>g:/pijlf0tq>gimq>gfq>g_q>gpq>g>cth" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt02b" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0?z,:hllej2b,l5s91.3.6.1.4.1.311.10.1201210215646z0/^g(o-cejy" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/use0g;gstertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com08f" - Source: "00000000-00002836.00000002.70052.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0or0<0:4http://crl3.digicert.com/digicertcsrsa4096rootg5.crl0a-_97h" - Source: "00000000-00002836.00000003.77480.04410000.00000004.mdmp") Found URL "https://www.newtonsoft.com/json" - Source: "00000000-00002836.00000003.77480.04410000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00002836.00000003.77480.04410000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002836.00000003.77480.04410000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002836.00000003.77480.04410000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigorsadomainvalidationsecureserverca.crt0" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0!*.ipify.org" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com08f" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5oentrust.net1;092www.entrust.net/cps" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!v>gqwv>g79;8kbv>g7v>g4v>guv>gntv>gliv>g" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrussq>g:/pijlf0tq>gimq>gfq>g_q>gpq>g>cth" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt02b" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0?z,:hllej2b,l5s91.3.6.1.4.1.311.10.1201210215646z0/^g(o-cejy" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/use0g;gstertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com08f" - Source: "00000000-00002836.00000003.77480.059F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0or HTTP/1.1 200 OK\nConnection: Keep-Alive\nKeep-Alive: timeout=5\n max=100\ncache-control: public\n max-age=604800\nexpires: Tue\n 16 May 2023 09:15:06 GMT\ncontent-type: image/png\nlast-modified: Tue\n 09 May 2023 08:44:17 GMT\naccept-ranges: bytes\ncontent-length: 1324376\ndate: Tue\n 09 May 2023 09:15:06 GMT\nserver: LiteSpeed with response body ==>.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\"NeueBestellung.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74B30000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e0084d59869@ADVAPI32.dll\"\n \"14001500c4d59869@ADVAPI32.dll\"\n \"14001500dcd59869@ADVAPI32.dll\"\n \"0c000d0024d69869@ADVAPI32.dll\"\n \"0c000d0034d69869@ADVAPI32.dll\"\n \"0e000f0044d69869@ADVAPI32.dll\"\n \"18001900acd79869@RPCRT4.dll\"\n \"13001400d8d79869@RPCRT4.dll\"\n \"14001500ecd79869@RPCRT4.dll\"\n \"1600170004d89869@RPCRT4.dll\"\n \"0b000c0068d19869@WS2_32.dll\"\n \"0d000e0010c09869@shell32.dll\"\n \"0d000e0064c09869@shell32.dll\"\n \"0d000e0054d69869@bcrypt.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.ipify.org\"\n \"blocexpert.eu\"\n \"teredo.ipv6.microsoft.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"NeueBestellung.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Installation/Persistence","name":"Read files","description":"\"NeueBestellung.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"NeueBestellung.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\"\n \"NeueBestellung.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\0b2f69b43a576b9edcc807a30872bd91\\system.ni.dll.aux\"\n \"NeueBestellung.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.net.http\\c1f72f0ca85cb675a88efe8f2067f7c8\\system.net.http.ni.dll.aux\"\n \"NeueBestellung.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"NeueBestellung.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"NeueBestellung.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"NeueBestellung.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"NeueBestellung.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"NeueBestellung.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"\n \"NeueBestellung.exe\" touched file \"C:\\Windows\\Microsoft.Net\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /.well-known/Vvgxgymdka.png\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00002836-00000C1F-14865820\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002836-00000C1F-20868634\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00002836-00000C1F-21445073\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00002836-00000C1F-23272032\")\n Found reference to API \"socket\" (Indicator: \"socket\"; Source: \"00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00002836.00000001.68132.054A0000.00000004.mdmp\n 00000000-00002836.00000002.70052.054A0000.00000004.mdmp\n 00000000-00002836.00000003.77480.054A0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00002836.00000001.68132.059F0000.00000004.mdmp\n 00000000-00002836.00000002.70052.059F0000.00000004.mdmp\n 00000000-00002836.00000003.77480.059F0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Network Related","name":"Found potential IP urls in memory dumps","description":"Found IP URL \"http://www.microsoft.com/windows0?z,:hllej2b,l5s91.3.6.1.4.1.311.10.1201210215646z0/^g(o-cejy\" - Source: \"00000000-00002836.00000001.68132.059F0000.00000004.mdmp\")\n Found IP URL \"http://www.microsoft.com/windows0?z,:hllej2b,l5s91.3.6.1.4.1.311.10.1201210215646z0/^g(o-cejy\" - Source: \"00000000-00002836.00000002.70052.059F0000.00000004.mdmp\")\n Found IP URL \"http://www.microsoft.com/windows0?z,:hllej2b,l5s91.3.6.1.4.1.311.10.1201210215646z0/^g(o-cejy\" - Source: \"00000000-00002836.00000003.77480.059F0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-3","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Network Related","name":"Found strings related to cloud services domains (possible C&C communication)","description":"Found string \"https://api.telegram.org/bot6236057808:AAEPjUfD2i1Z2Y6D-v4tJe2o-ZsIOYXQJ0Q/\" (Indicator: \"api.telegram.org\"; Source: \"00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp\")\n Found string \"https://api.telegram.org/bot6236057808:AAEPjUfD2i1Z2Y6D-v4tJe2o-X\" (Indicator: \"api.telegram.org\"; Source: \"00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.237.62.211\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00002836\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve registry keys (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00002836.00000001.68132.054A0000.00000004.mdmp, 00000000-00002836.00000002.70052.054A0000.00000004.mdmp, 00000000-00002836.00000003.77480.054A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"$46","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to file managers","description":"$47","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"k__BackingField\" (Indicator: \"\"; Source: \"00000000-00002836.00000001.68132.04410000.00000004.mdmp, 00000000-00002836.00000002.70052.04410000.00000004.mdmp, 00000000-00002836.00000003.77480.04410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002836.00000001.68132.00990000.00000004.mdmp, 00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000001.68132.029E0000.00000004.mdmp, 00000000-00002836.00000002.70052.00990000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.029E0000.00000004.mdmp, 00000000-00002836.00000003.77480.00990000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.029E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002836.00000001.68132.019E0000.00000004.mdmp, 00000000-00002836.00000002.70052.019E0000.00000004.mdmp, 00000000-00002836.00000003.77480.019E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002836-00000C1F-23871946","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"NeueBestellung.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"NeueBestellung.exe\" at 00000000-00002836-00000105-4375369","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"NeueBestellung.exe\" (Thread ID: 2056) slept \"520\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"NeueBestellung.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"sample.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 188.212.252.11 on port 80 is sent without HTTP header\n TCP traffic to 104.237.62.211 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - CRC-32 algorithm","description":"YARA signature for CRC-32 algorithm matched on process \"00000000-00002836\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-111","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Encryption logic used by malware","description":"YARA signature for encryption logic matched on process \"00000000-00002836\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-30","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"$49","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found Putty/Winscp session related registry strings","description":"\"SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"software\\martin prikryl\\winscp 2\\sessions\") in Source: 00000000-00002836.00000001.68132.019E0000.00000004.mdmp\n 00000000-00002836.00000002.70052.019E0000.00000004.mdmp\n 00000000-00002836.00000003.77480.019E0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-94","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"https://api.telegram.org/bot6236057808:AAEPjUfD2i1Z2Y6D-v4tJe2o-ZsIOYXQJ0Q/\" (Indicator: \"telegram.org\")\n \"https://api.telegram.org/bot6236057808:AAEPjUfD2i1Z2Y6D-v4tJe2o-X\" (Indicator: \"telegram.org\")\n \"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"$4a","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal VPN information (file access)","description":"\"NeueBestellung.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\NORDVPN\"\n \"NeueBestellung.exe\" trying to open a file \"%LOCALAPPDATA%\\NORDVPN\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-98","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"sample.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"api.ipify.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related registry keys","description":"\"NeueBestellung.exe\" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-31","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal FTP credentials from registry","description":"\"NeueBestellung.exe opens key \" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":5,"id":"registry-100","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Putty/Winscp sessions from registry","description":"\"NeueBestellung.exe opens key \" (Path: \"HKCU\\SOFTWARE\\MARTIN PRIKRYL\\WINSCP 2\\SESSIONS\")","origin":"Registry Access","mitre_attack_id":"T1552.002","relevance":10,"id":"registry-74","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$4d","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"645b8acca0c01752380e1a0b"},{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"645b8acca0c01752380e1a0b"},{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"645b8acca0c01752380e1a0b"},{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"name":"Spyware","details_count":3,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"name":"Stealer/Phishing","details_count":3,"details":[{"detail":"Reads FTP client related registry keys"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":105,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":3,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["windows-server-utility"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"645b8acca0c01752380e1a0b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Stealer.Agent","submit_name":"Neue Bestellung.exe","analysis_start_time":"2023-05-10T12:16:39+00:00","indicators_count":{"informative":62,"suspicious":14,"malicious":3},"is_in_unified_schema":true},{"id":"645a0e8d21aea7d3e101c503","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":59,"contacted_countries":["ROU","USA"],"submit_name":"Neue Bestellung.exe","analysis_start_time":"2023-05-09T09:12:46+00:00","indicators_count":{"informative":119,"suspicious":50,"malicious":7},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"188.212.252.11","port":80,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"address":"104.237.62.211","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]}],"dns_resolutions":[{"domain":"api.ipify.org","address":"104.237.62.211","ttl":300,"country":"United States","registrar_name":"eNom, Inc.","registrar_name_servers":"NS1.DNSIMPLE.COM","registrar_creation_date":"2014-01-05T22:02:15+00:00","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"domain":"blocexpert.eu","address":"188.212.252.11","ttl":14400,"country":"Romania","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"domain":"teredo.ipv6.microsoft.com","ttl":208,"country":"-","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1.MSFT.NET","registrar_creation_date":"1991-05-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]}],"http_requests":[{"host":"blocexpert.eu","host_ip":"188.212.252.11:80","url":"/.well-known/Vvgxgymdka.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /.well-known/Vvgxgymdka.png HTTP/1.1\nHost: blocexpert.eu\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"645b8acca0c01752380e1a0b"}],"processes":[{"pid":6852,"ppid":0,"name":"NeueBestellung.exe","command_line":"","sha256":"a86d1dc8abd7cdd7ce8eb34ee9e739c35ba49d2a4a4c9d62d0da1d2dc14addf1","normalized_path":"C:\\NeueBestellung.exe","uid":"00000000-00006852","icon":"$4e"}],"all_imported_dlls":["rpcrt4.dll","imm32.dll","vcruntime140_clr0400.dll","mscoreei.dll","mscorlib.ni.dll","cfgmgr32.dll","rsaenh.dll","advapi32.dll","ucrtbase_clr0400.dll","powrprof.dll","System.Xml.ni.dll","SHCore.dll","cryptsp.dll","dhcpcsvc6.dll","winnsi.dll","psapi.dll","shell32.dll","apphelp.dll","gdi32full.dll","msvcrt.dll","nsi.dll","ws2_32.dll","cryptbase.dll","bcryptprimitives.dll","ucrtbase.dll","combase.dll","clr.dll","windows.storage.dll","user32.dll","fltLib.dll","msvcp_win.dll","ntdll.dll","profapi.dll","bcrypt.dll","wow64win.dll","VxSSL32.dll","sechost.dll","clrjit.dll","System.Configuration.ni.dll","diasymreader.dll","kernel32.dll","win32u.dll","dhcpcsvc.dll","wow64.dll","mscoree.dll","gdi32.dll","ole32.dll","oleaut32.dll","shlwapi.dll","kernel.appcore.dll","sspicli.dll","IPHLPAPI.DLL","version.dll","System.Core.ni.dll","System.ni.dll","System.Net.Http.ni.dll","dnsapi.dll","wow64cpu.dll","KernelBase.dll","secur32.dll","vaultcli.dll","rasapi32.dll","mscorrc.dll","System.Runtime.Serialization.ni.dll","usp10.dll","System.Numerics.ni.dll","System.Windows.Forms.ni.dll","clbcatq.dll","rasman.dll","rtutils.dll","System.Web.Extensions.dll","msasn1.dll","WMINet_Utils.dll","FWPUCLNT.DLL","winhttp.dll","api-ms-win-core-xstate-l2-1-0.dll","wmiutils.dll","wbemprox.dll","comctl32.dll","WSHTCPIP.DLL","ntdsapi.dll","userenv.dll","gpapi.dll","schannel.dll","ncrypt.dll","uxtheme.dll","rasadhlp.dll","System.Data.ni.dll","System.Drawing.ni.dll","lpk.dll","wship6.dll","RpcRtRemote.dll","fastprox.dll","System.Security.ni.dll","webio.dll","mswsock.dll","credssp.dll","crypt32.dll","wbemcomn.dll","System.Data.dll","System.Management.ni.dll","nlssorting.dll","msctf.dll","api-ms-win-core-synch-l1-2-0.dll","wbemsvc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"645b8acca0c01752380e1a0b"},{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"645b8acca0c01752380e1a0b"},{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"645b8acca0c01752380e1a0b"},{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"645b8acca0c01752380e1a0b"},{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:6852:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"645b8acca0c01752380e1a0b"}]},{"name":"SM0:6852:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"645b8acca0c01752380e1a0b"}]},{"name":"SM0:6852:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"645b8acca0c01752380e1a0b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"645a0e8d21aea7d3e101c503"}]}]}},"report_ids":{"sandbox_job_ids":["645b8acca0c01752380e1a0b","645a0e8d21aea7d3e101c503"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample a86d1dc8abd7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a86d1dc8abd7…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a86d1dc8abd7cdd7ce8eb34ee9e739c35ba49d2a4a4c9d62d0da1d2dc14addf1"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample a86d1dc8abd7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a86d1dc8abd7…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a86d1dc8abd7cdd7ce8eb34ee9e739c35ba49d2a4a4c9d62d0da1d2dc14addf1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample a86d1dc8abd7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a86d1dc8abd7…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4f","11",{}]]