26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 5c047137f021… — Score 87/100 — Hybrid Analysis","description":"Malicious verdict for sample 5c047137f021…. Malware family: Win/malicious_confidence_90%. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5c047137f0216fadb95aaf302809eb0ac2f3db0c36729152c1351fb821d94fca","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","5c047137f0216fadb95aaf302809eb0ac2f3db0c36729152c1351fb821d94fca"],"about":{"@type":"SoftwareApplication","name":"quis.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"5c047137f0216fadb95aaf302809eb0ac2f3db0c36729152c1351fb821d94fca","additionalType":"Malicious sample"},"threatScore":87,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T658,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "quis.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "quis.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "quis.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "quis.exe") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "quis.exe") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "quis.exe") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "quis.exe") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp")28:T535,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "quis.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "quis.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "quis.exe") file/memory contains long string with (Indicator: "LoadLibrary"; File: "quis.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "quis.exe") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "quis.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp")29:T45d,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "quis.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "quis.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "quis.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "quis.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp")2a:T786,Found reference to "forHKDF" (Indicator: "HKDF"; File: "quis.exe") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "quis.exe") file/memory contains long string with (Indicator: "HMAC"; File: "quis.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "quis.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "quis.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "quis.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "quis.exe") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to "runtime.useAeshash" (Indicator: "Aes"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to "crypto/internal/fips140deps/cpu.ARM64HasSHA512" (Indicator: "SHA512"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to "crypto/internal/fips140deps/cpu.S390XHasSHA512" (Indicator: "SHA512"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp")2b:T689,"quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C") "quis.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\83DA05A9886F7658BE73ACF0A4930C0F99B92F01") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\83DA05A9886F7658BE73ACF0A4930C0F99B92F01") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4") "quis.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "quis.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB")2c:T6aff,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollableInstAltMatchunexpected )altmatch -> anynotnl -> gotypesaliashttpmuxgo121multipathtcptlsunsafeekmunknown sizeSeason count Average bees Largest hive Stable hives Health total level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625Letter_NumberGunjala_GondiMasaram_GondiMende_KikakuiOld_HungarianwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flush" (Indicator: "CertOpenStore"; File: "quis.exe") Found api reference "edWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersioninvalid UTF-8RegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasize#failfipscastHMAC-SHA2-256Average honey Average brood Average mites Smallest hive Reserve hives Lowest health Summary total %-12s -> %sfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #\.+*?()|[]{}^$1907348632812595367431640625asynctimerchanCombining_MarkDecimal_NumberEnclosing_MarkLine_SeparatoruserArenaStateGC (dedicated)" (Indicator: "CertCloseStore"; File: "quis.exe") Found api reference "edWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersioninvalid UTF-8RegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasize#failfipscastHMAC-SHA2-256Average honey Average brood Average mites Smallest hive Reserve hives Lowest health Summary total %-12s -> %sfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #\.+*?()|[]{}^$1907348632812595367431640625asynctimerchanCombining_MarkDecimal_NumberEnclosing_MarkLine_SeparatoruserArenaStateGC (dedicated)" (Indicator: "CryptGenRandom"; File: "quis.exe") Found api reference "untime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.TypeGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialLowest honey stock Largest projection Last honey reading bad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.Floatunexpected InstFail14901161193847656257450580596923828125Initial_PunctuationParagraph_SeparatorCanadian_AboriginalKhitan_Small_ScriptstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad ind" (Indicator: "CryptReleaseContext"; File: "quis.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersLargest honey stock Smallest projection Projection capacity invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625Egyptian_HieroglyphsMeroitic_Hieroglyphsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:byt" (Indicator: "CertOpenSystemStoreW"; File: "quis.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersLargest honey stock Smallest projection Projection capacity invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625Egyptian_HieroglyphsMeroitic_Hieroglyphsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:byt" (Indicator: "CryptAcquireContextW"; File: "quis.exe") Found api reference "trong waitchan receive (durable)send on closed channelcall not at safe pointgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free space/gc/scan/globals:bytes/gc/heap/frees:objectsruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=reflectlite.Value.Typeunexpected method stepRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResulterror parsing regexp: exit hook invoked exitsha3: Write after Readsimulated CAST failureApiary report complete ^[A-Z]{2,4}-[0-9]{2,5}$Cataloged %-12s tag=%sdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironment" (Indicator: "CertGetCertificateChain"; File: "quis.exe") Found api reference "evel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryW116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockinvalid pattern syntax: resource deadlock avoidedoperation now in progressno buffer space availableno such device or addresssocket type n" (Indicator: "CertFreeCertificateChain"; File: "quis.exe") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: testing simulated failure== Physical Properties ==invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandle145519152283668518066406257275957614183425903320" (Indicator: "CertFreeCertificateContext"; File: "quis.exe"), Found api reference "3125all goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryunknown ABI parameter kindRtlNtStatusToDosErrorNoTeb== Xlxjobjtl Candidates ==channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStore363797880709171295166015625PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "quis.exe"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointerexpression nests too deeplyabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18" (Indicator: "CertCreateCertificateContext"; File: "quis.exe"), Found api reference "llocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countr" (Indicator: "CertAddCertificateContextToStore"; File: "quis.exe"), Found api reference "llocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countr" (Indicator: "CertVerifyCertificateChainPolicy"; File: "quis.exe"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollableInstAltMatchunexpected )altmatch -> anynotnl -> gotypesaliashttpmuxgo121multipathtcptlsunsafeekmunknown sizeSeason count Average bees Largest hive Stable hives Health total level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625Letter_NumberGunjala_GondiMasaram_GondiMende_KikakuiOld_HungarianwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flus" (Indicator: "CertOpenStore"; File: "quis.exe"), Found api reference "edWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersioninvalid UTF-8RegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasize#failfipscastHMAC-SHA2-256Average honey Average brood Average mites Smallest hive Reserve hives Lowest health Summary total %-12s -> %sfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #\.+*?()|[]{}^$1907348632812595367431640625asynctimerchanCombining_MarkDecimal_NumberEnclosing_MarkLine_SeparatoruserArenaStateGC (dedicated" (Indicator: "CertCloseStore"; File: "quis.exe") Found api reference "edWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersioninvalid UTF-8RegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasize#failfipscastHMAC-SHA2-256Average honey Average brood Average mites Smallest hive Reserve hives Lowest health Summary total %-12s -> %sfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #\.+*?()|[]{}^$1907348632812595367431640625asynctimerchanCombining_MarkDecimal_NumberEnclosing_MarkLine_SeparatoruserArenaStateGC (dedicated" (Indicator: "CryptGenRandom"; File: "quis.exe") Found api reference "untime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.TypeGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialLowest honey stock Largest projection Last honey reading bad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.Floatunexpected InstFail14901161193847656257450580596923828125Initial_PunctuationParagraph_SeparatorCanadian_AboriginalKhitan_Small_ScriptstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad in" (Indicator: "CryptReleaseContext"; File: "quis.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersLargest honey stock Smallest projection Projection capacity invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625Egyptian_HieroglyphsMeroitic_Hieroglyphsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:by" (Indicator: "CertOpenSystemStoreW"; File: "quis.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersLargest honey stock Smallest projection Projection capacity invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625Egyptian_HieroglyphsMeroitic_Hieroglyphsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:by" (Indicator: "CryptAcquireContextW"; File: "quis.exe") Found api reference "trong waitchan receive (durable)send on closed channelcall not at safe pointgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free space/gc/scan/globals:bytes/gc/heap/frees:objectsruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=reflectlite.Value.Typeunexpected method stepRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResulterror parsing regexp: exit hook invoked exitsha3: Write after Readsimulated CAST failureApiary report complete ^[A-Z]{2,4}-[0-9]{2,5}$Cataloged %-12s tag=%sdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmen" (Indicator: "CertGetCertificateChain"; File: "quis.exe") Found api reference "evel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryW116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockinvalid pattern syntax: resource deadlock avoidedoperation now in progressno buffer space availableno such device or addresssocket type" (Indicator: "CertFreeCertificateChain"; File: "quis.exe") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: testing simulated failure== Physical Properties ==invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandle14551915228366851806640625727595761418342590332" (Indicator: "CertFreeCertificateContext"; File: "quis.exe"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointerexpression nests too deeplyabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx1" (Indicator: "CertCreateCertificateContext"; File: "quis.exe"), Found api reference "llocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation count" (Indicator: "CertAddCertificateContextToStore"; File: "quis.exe"), Found api reference "llocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation count" (Indicator: "CertVerifyCertificateChainPolicy"; File: "quis.exe")2d:Tb8f,Observed string: "crypto/sha1" (Indicator: "crypto/sha1") in Source: quis.exe Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: quis.exe Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: quis.exe Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: quis.exe Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: quis.exe Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: quis.exe Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: quis.exe Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: quis.exe Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: quis.exe Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: quis.exe Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: quis.exe Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: quis.exe Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: quis.exe Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: quis.exe Observed string: "crypto/internal/sysrand.warnBlocked" (Indicator: "crypto/internal/sysrand.warnBlocked") in Source: quis.exe Observed string: "crypto/internal/sysrand.Read" (Indicator: "crypto/internal/sysrand.Read") in Source: quis.exe Observed string: "crypto/internal/sysrand.read" (Indicator: "crypto/internal/sysrand.read") in Source: quis.exe Observed string: "crypto/internal/sysrand.Read.deferwrap1" (Indicator: "crypto/internal/sysrand.Read.deferwrap1") in Source: quis.exe Observed string: "crypto/internal/entropy.Depleted" (Indicator: "crypto/internal/entropy.Depleted") in Source: quis.exe Observed string: "crypto/internal/fips140only.init" (Indicator: "crypto/internal/fips140only.init") in Source: quis.exe Observed string: "crypto/internal/boring/sig.StandardCrypto" (Indicator: "crypto/internal/boring/sig.StandardCrypto") in Source: quis.exe Observed string: "crypto/sha1.init" (Indicator: "crypto/sha1.init") in Source: quis.exe Observed string: "crypto/sha1.init.0" (Indicator: "crypto/sha1.init.0") in Source: quis.exe Observed string: "crypto/sha1.(*digest).MarshalBinary" (Indicator: "crypto/sha1.(*digest).MarshalBinary") in Source: quis.exe, Observed string: "crypto/sha1.(*digest).AppendBinary" (Indicator: "crypto/sha1.(*digest).AppendBinary") in Source: quis.exe2e:Tabf,Contains base64 string in header "POST" in header "POST / HTTP/1.1Content-Type: application/jsonHost: bsc.blockrazor.xyzContent-Length: 200Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST / HTTP/1.1Content-Type: application/jsonHost: bsc.blockrazor.xyzContent-Length: 200Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST / HTTP/1.1Content-Type: application/jsonHost: bsc.blockrazor.xyzContent-Length: 200Cache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST / HTTP/1.1Content-Type: application/jsonHost: bsc.blockrazor.xyzContent-Length: 200Cache-Control: no-cache" Contains base64 string in header "200Cache" in header "POST / HTTP/1.1Content-Type: application/jsonHost: bsc.blockrazor.xyzContent-Length: 200Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST / HTTP/1.1Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480Content-Type: application/x-www-form-urlencodedHost: celebration-internet.ccContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "824c6b4d" in header "POST / HTTP/1.1Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480Content-Type: application/x-www-form-urlencodedHost: celebration-internet.ccContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "4f01" in header "POST / HTTP/1.1Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480Content-Type: application/x-www-form-urlencodedHost: celebration-internet.ccContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "4e22" in header "POST / HTTP/1.1Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480Content-Type: application/x-www-form-urlencodedHost: celebration-internet.ccContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "a500" in header "POST / HTTP/1.1Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480Content-Type: application/x-www-form-urlencodedHost: celebration-internet.ccContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST / HTTP/1.1Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480Content-Type: application/x-www-form-urlencodedHost: celebration-internet.ccContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "form" in header "POST / HTTP/1.1Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480Content-Type: application/x-www-form-urlencodedHost: celebration-internet.ccContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "internet" in header "POST / HTTP/1.1Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480Content-Type: application/x-www-form-urlencodedHost: celebration-internet.ccContent-Length: 52Cache-Control: no-cache"2f:T1c43,Found XOR loop in file "sample.bin" at offset 25877; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 94706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2715721; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2754377; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2903081; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3243433; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3553244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3599952; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3784664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3784712; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3785732; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3785888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3785948; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3786200; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3786632; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3787364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3788060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3788888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3788996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3789368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3791096; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3791636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3792092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3792140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3792368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3792848; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3793148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3793160; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3793412; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3794024; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3794108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3794132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3794444; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3794948; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3794996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3795320; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3795332; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3796928; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3797144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3798692; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3799388; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3800204; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3800216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3800240; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3800540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3800660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3800948; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3801104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3801224; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3801248; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3801284; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3801608; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3801680; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3802520; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3802868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3802880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3802916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3803012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3803300; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3803336; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3803480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3803540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3803588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3803984; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3804032; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3804044; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3804500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3804572; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3805472; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3805964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3806252; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3806288; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3806804; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3310101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3336479; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 191318; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229489; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232051; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254641; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 274768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418629; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419325; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419966; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 430345; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1512208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1646168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2472545; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2698777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2712371; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2800349; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2812853; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3083241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3438996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3792792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3801000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3801036; code bytes = 803030:T419,file/memory contains long string with (Indicator: "GetCommandLine"; File: "quis.exe") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "quis.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002372-00000C2C-3428312636") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002372-00000C2C-3428863698") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp")31:T9ce,"quis.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000051a76981fe7f00000000000000000000000000000000000010eb3f1dee000000000000000000000060ea3f1dee00000010337781fe7f0000000000000000000090327781fe7f0000040000000000000028eb3f1dee000000000000000000000001ef3f1dee000000000000000000000076c56b81fe7f00000000000000000000000000000000000001ef3f1dee000000000000000000000000eb3f1dee00000098bd2663ee01000000100000000000000300000000000000080000000f00000001000000ee010000600c7c61ee010000ffffffff0f00000028eb3f1dee000000c3f06681fe7f000000777c61ee010000e8846781fe7f0000e0bf7c61 (UID: 00000000-00002372) "quis.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002372) "quis.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002372) "quis.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002372)32:T4cf,"quis.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "quis.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "quis.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "quis.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "quis.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "quis.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "quis.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "quis.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "quis.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "quis.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")33:T496,"quis.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002372) "quis.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002372)34:T2ef2,"quis.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter FindFirstFileExW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlCaptureContext (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlLookupFunctionEntry (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlPcToFileHeader (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlUnwindEx (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter EmptyClipboard (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter GetClipboardData (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter IsClipboardFormatAvailable (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter SetClipboardData (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter HttpAddRequestHeadersA (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter NtFreeVirtualMemory (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlAcquireSRWLockExclusive (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlEqualUnicodeString (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlExitUserProcess (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlReleaseSRWLockExclusive (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter RtlWaitOnAddress (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002372) "quis.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002372)35:T58bb,Found reference to API (Indicator: "CloseHandle"; File: "quis.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "quis.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "quis.exe") Found reference to API (Indicator: "ExitProcess"; File: "quis.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "quis.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "quis.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "quis.exe") Found reference to API (Indicator: "CreateEventA"; File: "quis.exe") Found reference to API (Indicator: "WerGetFlags"; File: "quis.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "quis.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "quis.exe") Found reference to API (Indicator: "SetThreadContext"; File: "quis.exe") Found reference to API (Indicator: "VirtualFree"; File: "quis.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "quis.exe") Found reference to API (Indicator: "TlsAlloc"; File: "quis.exe") Found reference to API (Indicator: "SuspendThread"; File: "quis.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "quis.exe") Found reference to API (Indicator: "WriteFile"; File: "quis.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "quis.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "quis.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "quis.exe") Found reference to API (Indicator: "GetProcAddress"; File: "quis.exe") Found reference to API (Indicator: "WerSetFlags"; File: "quis.exe") Found reference to API (Indicator: "VirtualQuery"; File: "quis.exe") Found reference to API (Indicator: "CreateThread"; File: "quis.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "quis.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "quis.exe") Found reference to API (Indicator: "ResumeThread"; File: "quis.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "quis.exe") Found reference to API (Indicator: "GetThreadContext"; File: "quis.exe") Found reference to API (Indicator: "SwitchToThread"; File: "quis.exe") Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "quis.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "quis.exe") Found reference to API (Indicator: "SetEvent"; File: "quis.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "quis.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "quis.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "quis.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "quis.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "quis.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "quis.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "quis.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "quis.exe") Found reference to API (Indicator: "SetErrorMode"; File: "quis.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "quis.exe") Found reference to API (Indicator: "GetErrorMode"; File: "quis.exe") Found reference to API (Indicator: "GetStdHandle"; File: "quis.exe") Found reference to API (Indicator: "WSAIoctl"; File: "quis.exe") Found reference to API (Indicator: "GetFileType"; File: "quis.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "quis.exe") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersA"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "NtAllocateVirtualMemory"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "NtFreeVirtualMemory"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "NtQueryInformationFile"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlAcquireSRWLockExclusive"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlEqualUnicodeString"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlExitUserProcess"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlReleaseSRWLockExclusive"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp")36:T902,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp 00000000-00002372.00000001.285284.617B0000.00000004.mdmp 00000000-00002372.00000002.287205.617B0000.00000004.mdmp 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp "\Registry\Machine\Software\Class" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp 00000000-00002372.00000001.285284.617B0000.00000004.mdmp 00000000-00002372.00000002.287205.617B0000.00000004.mdmp 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "4-\Registry\Machine\Software\Classes\WOW6432Node\CLSI" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp 00000000-00002372.00000001.285284.617B0000.00000004.mdmp 00000000-00002372.00000002.287205.617B0000.00000004.mdmp 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "\Machine\Software\Clas" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp 00000000-00002372.00000001.285284.617B0000.00000004.mdmp 00000000-00002372.00000002.287205.617B0000.00000004.mdmp 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp 00000000-00002372.00000001.285284.617B0000.00000004.mdmp 00000000-00002372.00000002.287205.617B0000.00000004.mdmp 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp 00000000-00002372.00000001.285284.617B0000.00000004.mdmp 00000000-00002372.00000002.287205.617B0000.00000004.mdmp 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00002372.00000001.285284.69030000.00000004.mdmp 00000000-00002372.00000002.287205.69030000.00000004.mdmp 00000000-00002372.00000003.292710.69030000.00000004.mdmp37:T450,Process quis.exe created mutex with name "\Sessions\1\BaseNamedObjects\update-S-2-5-26-24247216-2331352693-3112950123" Process quis.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2372:304:WilStaging_02" Process quis.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2372:304:WilStaging_02" Process quis.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2372:120:WilError_01" Process quis.exe created mutex with name "Local\ZonesCacheCounterMutex" Process quis.exe created mutex with name "Local\SM0:2372:304:WilStaging_02" Process quis.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process quis.exe created mutex with name "SM0:2372:120:WilError_01" Process quis.exe created mutex with name "update-S-2-5-26-24247216-2331352693-3112950123" Process quis.exe created mutex with name "SM0:2372:304:WilStaging_02" Process quis.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process quis.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"38:Te21,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp "\Registry\Machine\Software\Class" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp "4-\Registry\Machine\Software\Classes\WOW6432Node\CLSI" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp "\Machine\Software\Clas" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002372.00000001.285284.617B0000.00000004.mdmp "\Registry\Machine\Software\Class" in Source: 00000000-00002372.00000001.285284.617B0000.00000004.mdmp "4-\Registry\Machine\Software\Classes\WOW6432Node\CLSI" in Source: 00000000-00002372.00000001.285284.617B0000.00000004.mdmp "\Machine\Software\Clas" in Source: 00000000-00002372.00000001.285284.617B0000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00002372.00000001.285284.617B0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002372.00000001.285284.617B0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00002372.00000001.285284.69030000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002372.00000002.287205.617B0000.00000004.mdmp "\Registry\Machine\Software\Class" in Source: 00000000-00002372.00000002.287205.617B0000.00000004.mdmp "4-\Registry\Machine\Software\Classes\WOW6432Node\CLSI" in Source: 00000000-00002372.00000002.287205.617B0000.00000004.mdmp "\Machine\Software\Clas" in Source: 00000000-00002372.00000002.287205.617B0000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00002372.00000002.287205.617B0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002372.00000002.287205.617B0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00002372.00000002.287205.69030000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "\Registry\Machine\Software\Class" in Source: 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "4-\Registry\Machine\Software\Classes\WOW6432Node\CLSI" in Source: 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "\Machine\Software\Clas" in Source: 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002372.00000003.292710.617B0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00002372.00000003.292710.69030000.00000004.mdmp39:Taf1,"quis.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe6a7d0000 "quis.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffe7e650000 "quis.exe" loaded module "NTDLL.DLL" at base 7ffe81660000 "quis.exe" loaded module "WINMM.DLL" at base 7ffe75c00000 "quis.exe" loaded module "POWRPROF.DLL" at base 7ffe7d9d0000 "quis.exe" loaded module "KERNEL32.DLL" at base 7ffe7f120000 "quis.exe" loaded module "OLEAUT32.DLL" at base 7ffe7f280000 "quis.exe" loaded module "OLE32.DLL" at base 7ffe7fe50000 "quis.exe" loaded module "USER32.DLL" at base 7ffe7ef90000 "quis.exe" loaded module "WININET.DLL" at base 7ffe6bbb0000 "quis.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffe7e3e0000 "quis.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe7e3e0000 "quis.exe" loaded module "KERNEL32" at base 7ffe7f120000 "quis.exe" loaded module "RPCRT4.DLL" at base 7ffe81510000 "quis.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffe7e3e0000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffe743c0000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffe72570000 "quis.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffe7e3e0000 "quis.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffe7e3e0000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffe71d50000 "quis.exe" loaded module "SSPICLI.DLL" at base 7ffe7d8b0000 "quis.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 7ffe5f0d0000 "quis.exe" loaded module "WINHTTP.DLL" at base 7ffe79f60000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffe5f0d0000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffe7d240000 "quis.exe" loaded module "MSISO.DLL" at base 7ffe6a6c0000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffe763b0000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffe76870000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 7ffe81440000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffe7cd30000 "quis.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffe6cdb0000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffe7da60000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe7cdf0000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe7e650000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ffe689c0000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffe7e870000 "quis.exe" loaded module "CRYPTNET.DLL" at base 7ffe689c0000 "quis.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffe6e4100003a:T415,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: A9:84:01:BB:E7:10:FF:30:A0:C8:FB:21:B2:01:FC:36:3C:04:45:1E; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 26:D7:08:C6:CE:45:54:E9:FE:D0:AE:35:55:65:01:FA:F8:D0:B0:1C; see report for more information) The input sample is signed with a certificate issued by "CN=gilgilgil.de, O=0Hk5iAf5mWFTGx, L=8bDUz, ST=kiglrFx, C=US" (SHA1: BB:51:B7:B2:19:20:EF:2F:03:C9:A4:88:7B:BD:0B:81:92:2F:D5:1C; see report for more information)3b:T422,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "quis.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "quis.exe") file/memory contains long string with (Indicator: "LoadLibrary"; File: "quis.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "quis.exe") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "quis.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp")3c:T6e4,"quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\QUIS.EXE"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKCU\APPID\QUIS.EXE"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\APPID\QUIS.EXE"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS"; Key: ""; Value: "") "quis.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS"; Key: ""; Value: "")3d:T833,"quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "ANONYMOUSAPPCONTAINERIMPERSONATIONLEVELCHECK"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "EVERYONEINCLUDESANONYMOUS"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "")3e:T522,"quis.exe" trying to access non-existent file "C:\FLTLIB.DLL" "quis.exe" trying to access non-existent file "C:\MSVCP140.DLL" "quis.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "quis.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "quis.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "quis.exe" trying to access non-existent file "C:\WININET.DLL" "quis.exe" trying to access non-existent file "C:\WININET.dll" "quis.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "quis.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "quis.exe" trying to access non-existent file "C:\Windows\System32\wbem\BCRYPT.DLL" "quis.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\bcrypt.dll" "quis.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "quis.exe" trying to access non-existent file "C:\iertutil.dll" "quis.exe" trying to access non-existent file "C:\SSPICLI.DLL" "quis.exe" trying to access non-existent file "C:\SspiCli.dll" "quis.exe" trying to access non-existent file "C:\URLMON.DLL" "quis.exe" trying to access non-existent file "C:\urlmon.dll" "quis.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "quis.exe" trying to access non-existent file "C:\DPAPI.DLL"3f:Tb07,file/memory contains long string with (Indicator: "WSARecv"; File: "quis.exe") file/memory contains long string with (Indicator: "WSASend"; File: "quis.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "quis.exe") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; File: "quis.exe") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "quis.exe") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00002372-00000C2C-3429292426") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00002372-00000C2C-3429296421") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00002372-00000C2C-3429304452") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002372-00000C2C-3429308403") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002372-00000C2C-3429329188") Found reference to API "998,3244,3237,,InternetReadFile,Wininet.dll,"01:13:48.359",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00002372.00000001.285284.69030000.00000004.mdmp, 00000000-00002372.00000002.287205.69030000.00000004.mdmp") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp")40:T1dc4,Heuristic match: "*abi.name" Heuristic match: "*godebugs.info" Pattern match: "https://go.dev/issue/66821" Heuristic match: "celebration-internet.cc" Heuristic match: "internal/abi.name.name" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Heuristic match: "errors.is" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Heuristic match: "unicode.to" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Pattern match: "eq.io/fs.patherror" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.value.int" Heuristic match: "regexp/syntax.(*compiler).cat" Heuristic match: "regexp/syntax.bw" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "https://bsc.blockrazor.xyz/" Pattern match: "agram.com/justinbieber" Heuristic match: "elebration-internet.cc" Heuristic match: "*.celebration-internet.cc" Pattern match: "ww.instagram.com/justinbieber" Heuristic match: "ntrust.net" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%2" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20tls%20ecc%20root%20g2.c" Heuristic match: "hostcelebration-internet.cc" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=ptmcdspom2cdfscleebx9krhnv3ytqzpob7yzrvkddgz5d4vsxmgaxitokwhtr2ddzl9sdwck%2btkqs8uz8%2f9gqod7cssnpnekkxdqikem87egmcrhk8msfuky0mlbm%2bnqwgvarcqobiflq%3d%3d" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=mgjcv78boari804%2fugkhh7u1bbttjeufraf53a89h0iosnidijeunj4fmves8%2fyywukmrmmr7gyiyvdtzv0f6ulmugbnqpicfigmd%2f8d%2fag%2bqphnkfuxx8fvrt1wrqnp3fefca%3d%3d" Heuristic match: "host: celebration-internet.cc" Pattern match: "https://celebration-internet.cc/" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Heuristic match: "qk.mr" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Heuristic match: "rnet.cc" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "http://crl.microsoft" Pattern match: "rl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microocera" Heuristic match: "ternet.cc" Pattern match: "www.instagram.com/justinbieber" Heuristic match: "unicode.cc" Heuristic match: "unicode.cf" Heuristic match: "unicode.cn" Heuristic match: "unicode.co" Heuristic match: "unicode.lc" Heuristic match: "unicode.mc" Heuristic match: "unicode.me" Heuristic match: "unicode.mn" Heuristic match: "unicode.nl" Heuristic match: "unicode.no" Heuristic match: "unicode.pe" Heuristic match: "unicode.pf" Heuristic match: "unicode.ps" Heuristic match: "unicode.sc" Heuristic match: "unicode.sk" Heuristic match: "unicode.sm" Heuristic match: "unicode.so" Heuristic match: "unicode.lt" Heuristic match: "unicode.lu" Heuristic match: "rf.er" Heuristic match: "tu.fo" Pattern match: "it.com/r/gifs" Pattern match: "ww.youtube.com/watch?v=9bzkp7q19f0" Pattern match: "www.reddit.com/r/gifs" Pattern match: "ww.reddit.com/r/gifs"41:T340f,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002372.00000001.285284.617B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002372.00000001.285284.69030000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002372.00000001.285284.69030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002372.00000001.285284.69030000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002372.00000001.285284.69030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002372.00000001.285284.69030000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002372.00000001.285284.69030000.00000004.mdmp") Found URL "http://crl.microsoftrsa10yykcahbwv$_ntye1$0" - Source: "00000000-00002372.00000001.285284.69030000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microocera" - Source: "00000000-00002372.00000001.285284.69030000.00000004.mdmp") Found URL "http://microsoft.com0k\" - Source: "00000000-00002372.00000001.285284.69030000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=ptmcdspom2cdfscleebx9krhnv3ytqzpob7yzrvkddgz5d4vsxmgaxitokwhtr2ddzl9sdwck%2btkqs8uz8%2f9gqod7cssnpnekkxdqikem87egmcrhk8msfuky0mlbm%2bnqwgvarcqobiflq%3d%3d" - Source: "00000000-00002372.00000001.285284.69030000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002372.00000002.287205.617B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002372.00000002.287205.69030000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002372.00000002.287205.69030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002372.00000002.287205.69030000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002372.00000002.287205.69030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002372.00000002.287205.69030000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002372.00000002.287205.69030000.00000004.mdmp") Found URL "http://crl.microsoftrsa10yykcahbwv$_ntye1$0" - Source: "00000000-00002372.00000002.287205.69030000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microocera" - Source: "00000000-00002372.00000002.287205.69030000.00000004.mdmp") Found URL "http://microsoft.com0k\" - Source: "00000000-00002372.00000002.287205.69030000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=ptmcdspom2cdfscleebx9krhnv3ytqzpob7yzrvkddgz5d4vsxmgaxitokwhtr2ddzl9sdwck%2btkqs8uz8%2f9gqod7cssnpnekkxdqikem87egmcrhk8msfuky0mlbm%2bnqwgvarcqobiflq%3d%3d" - Source: "00000000-00002372.00000002.287205.69030000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002372.00000003.292710.617B0000.00000004.mdmp") Found URL "https://bsc.blockrazor.xyz/pgrj" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=mgjcv78boari804%2fugkhh7u1bbttjeufraf53a89h0iosnidijeunj4fmves8%2fyywukmrmmr7gyiyvdtzv0f6ulmugbnqpicfigmd%2f8d%2fag%2bqphnkfuxx8fvrt1wrqnp3fefca%3d%3d" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "https://celebration-internet.cc/ir+=y/e" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcirs]thawte," - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eirvvglobalsign" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuup%hhsmookh" - Source: "00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002372.00000003.292710.69030000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002372.00000003.292710.69030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002372.00000003.292710.69030000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002372.00000003.292710.69030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002372.00000003.292710.69030000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002372.00000003.292710.69030000.00000004.mdmp") Found URL "http://crl.microsoftrsa10yykcahbwv$_ntye1$0" - Source: "00000000-00002372.00000003.292710.69030000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microocera" - Source: "00000000-00002372.00000003.292710.69030000.00000004.mdmp") Found URL "http://microsoft.com0k\" - Source: "00000000-00002372.00000003.292710.69030000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=ptmcdspom2cdfscleebx9krhnv3ytqzpob7yzrvkddgz5d4vsxmgaxitokwhtr2ddzl9sdwck%2btkqs8uz8%2f9gqod7cssnpnekkxdqikem87egmcrhk8msfuky0mlbm%2bnqwgvarcqobiflq%3d%3d" - Source: "00000000-00002372.00000003.292710.69030000.00000004.mdmp")42:T51d,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp") Found string "+ncalrpc:[OLE0ADDC762051ED084F6E4171CB576]" (Indicator: "ncalrpc"; Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp") Found string "+ncalrpc:[OLECB2EFCC6B1B8B5EF5715C2BCA678]" (Indicator: "ncalrpc"; Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp") Found string "B+ncalrpc:[OLE0ADDC762051ED084F6E4171CB576]" (Indicator: "ncalrpc"; Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp")43:T4be,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp")44:T7a1,Found string "chacha8" (Indicator: "chacha"; File: "quis.exe") Found string "*aes.CTR" (Indicator: "aes"; File: "quis.exe") Found string "*aes.Block" (Indicator: "aes"; File: "quis.exe") Found string "*aes.block" (Indicator: "aes"; File: "quis.exe") Found string "encoding/base64" (Indicator: "base64"; File: "quis.exe") Found string "*base64.Encoding" (Indicator: "base64"; File: "quis.exe") Found string "*aes.KeySizeError" (Indicator: "aes"; File: "quis.exe") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "quis.exe") Found string "*aes.blockExpanded" (Indicator: "aes"; File: "quis.exe") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "quis.exe") Found string "crypto/internal/fips140/aes" (Indicator: "aes"; File: "quis.exe") file/memory contains long string with (Indicator: "aes"; File: "quis.exe") file/memory contains long string with (Indicator: "3des"; File: "quis.exe") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "quis.exe") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "quis.exe") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "quis.exe") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "quis.exe") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "quis.exe") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "quis.exe") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "quis.exe") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "quis.exe") Found string "aeshashbody" (Indicator: "aes"; File: "quis.exe") Found string "encoding/base64.init" (Indicator: "base64"; File: "quis.exe") Found string "encoding/base64.NewEncoding" (Indicator: "base64"; File: "quis.exe") Found string "encoding/base64.Encoding.WithPadding" (Indicator: "base64"; File: "quis.exe")45:T72d,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "quis.exe") file/memory contains long string with (Indicator: "Process32Next"; File: "quis.exe") file/memory contains long string with (Indicator: "Module32Next"; File: "quis.exe") file/memory contains long string with (Indicator: "Process32First"; File: "quis.exe") file/memory contains long string with (Indicator: "Module32First"; File: "quis.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "quis.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "quis.exe") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "quis.exe") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "quis.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp")46:T75b,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "quis.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "quis.exe") file/memory contains long string with (Indicator: "GetTempPath"; File: "quis.exe") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "quis.exe") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "quis.exe") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "quis.exe") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "quis.exe") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "quis.exe") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "quis.exe") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "quis.exe") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "os.useGetTempPath2" (Indicator: "GetTempPath"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "internal/syscall/windows.procGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "internal/syscall/windows.procNtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp")47:T488,file/memory contains long string with (Indicator: "CopySid"; File: "quis.exe") file/memory contains long string with (Indicator: "IsValidSid"; File: "quis.exe") file/memory contains long string with (Indicator: "GetLengthSid"; File: "quis.exe") file/memory contains long string with (Indicator: "RevertToSelf"; File: "quis.exe") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "quis.exe") file/memory contains long string with (Indicator: "DuplicateToken"; File: "quis.exe") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "quis.exe") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "quis.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "quis.exe") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "quis.exe") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "quis.exe") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "quis.exe") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "quis.exe")48:T6e6,"quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "quis.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")49:T4ea,"quis.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "quis.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "quis.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "quis.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "quis.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "quis.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "quis.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "quis.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")4a:T817,"POST / HTTP/1.1 Content-Type: application/json Host: bsc.blockrazor.xyz Content-Length: 200 Cache-Control: no-cache" with payload::==> "{"id":1,"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x77c08D8A4Eab268fd5728ae8fE41b1FDE52967dF","data":"0x70a08231000000000000000000000000135b96a3e7ccaf7c19ef5a33ce5427c5e46362fa"},"latest"]}" HTTP/1.1 200 OK Date: Sat 08 Aug 2026 08:39:27 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Vary: Origin vary: accept-encoding cf-cache-status: DYNAMIC set-cookie: __cflb=0H28vjNUKzitFxPEZazBvS4yYFkMLyrHRTuyfPLrHu5; HttpOnly; SameSite=Lax; Path=/; Expires=Sat 15 Aug 2026 08:39:27 GMT Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=MgJcv78BoAri804%2FugKHH7U1bBTTJeUFRaf53a89H0IoSNidijeunJ4fMVES8%2FyYWUkmRmMr7GYIYvDTZv0f6uLmuGBnQPICfiGmd%2F8D%2FaG%2BqPhnkFUxx8fVrt1wRQnP3FEfcA%3D%3D"}]} Server: cloudflare CF-RAY: a27d35e998d3c782-SJC with response body ==>7B226A736F6E727063223A22322E30222C226964223A312C22726573756C74223A22307830303030303030303030303030303030303030303030303030303030....... "POST / HTTP/1.1 Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480 Content-Type: application/x-www-form-urlencoded Host: celebration-internet.cc Content-Length: 52 Cache-Control: no-cache" with payload::==> "method=refresh&guid=9C9DB77D37251689D518551CEF31C022" HTTP/1.1 200 OK Date: Sat 08 Aug 2026 08:39:27 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Alt-Svc: h3=":443"; ma=86400 cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ptmCDsPoM2cdFScLEEbx9krhNV3yTqzpoB7YZRVKDDGZ5d4vSxmgAXitOkwHTr2dDZL9SDWcK%2BtKqS8uz8%2F9Gqod7CSSnPneKkxDqIkEm87EgmcRhK8MsfUky0mlbM%2BNQWGvarCqoBIFLQ%3D%3D"}]} CF-RAY: a27d35ea9da9ef28-SJC with response body ==>6F6B.......4b:Ta2b,Found string "icrosoft\Windows\INetCookies" (Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp") Found string "INetCookies" (Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found string "??\c:\users\hapubws\appdata\local\microsoft\windows\inetcookies" (Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found string ":\users\hapubws\appdata\local\microsoft\windows\inetcookies" (Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies\" (Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found string "ers\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp") Found string "USERPROFILE%\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies\DNTException\" (Source: "00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp")4c:Tacb,"quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "quis.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "quis.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"5c047137f0216fadb95aaf302809eb0ac2f3db0c36729152c1351fb821d94fca","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":87,"unified_at_epoch_ms":1791936961043,"unified_at":"2026-10-14T00:16:01.043Z","metadata":{"hashes":{"sha256":"5c047137f0216fadb95aaf302809eb0ac2f3db0c36729152c1351fb821d94fca","sha1":"494832005793fe3cf94814a79cdbda455dbfc197","md5":"c3b3b58a8af1db66d1545d96c0eb78ce","sha512":"f553298e6c1d3f59d241faa3b7f068275fbc2860ce436627e0b551e0e4d1fa55a4e5c6d1dd9f0df626ed0b8ee082ea0087ffabec781b78469a0a9595a5db0ad4","ssdeep":"49152:aWbirj7IXa/baXHl1tYDPsAKQwvyt+zRksVwX4VcLwU:aLEXHv9mtmRkpXL","ssdeep_chunks":["49152:aWbirj7","49152:Wbirj7I","49152:birj7IX","49152:irj7IXa","49152:rj7IXa/","49152:j7IXa/b","49152:7IXa/ba","49152:IXa/baX","49152:Xa/baXH","49152:a/baXHl","49152:/baXHl1","49152:baXHl1t","49152:aXHl1tY","49152:XHl1tYD","49152:Hl1tYDP","49152:l1tYDPs","49152:1tYDPsA","49152:tYDPsAK","49152:YDPsAKQ","49152:DPsAKQw","49152:PsAKQwv","49152:sAKQwvy","49152:AKQwvyt","49152:KQwvyt+","49152:Qwvyt+z","49152:wvyt+zR","49152:vyt+zRk","49152:yt+zRks","49152:t+zRksV","49152:+zRksVw","49152:zRksVwX","49152:RksVwX4","49152:ksVwX4V","49152:sVwX4Vc","49152:VwX4VcL","49152:wX4VcLw","49152:X4VcLwU","98304:aWbirj7","98304:Wbirj7I","98304:birj7IX","98304:irj7IXa","98304:rj7IXa/","98304:j7IXa/b","98304:7IXa/ba","98304:IXa/baX","98304:Xa/baXH","98304:a/baXHl","98304:/baXHl1","98304:baXHl1t","98304:aXHl1tY","98304:XHl1tYD","98304:Hl1tYDP","98304:l1tYDPs","98304:1tYDPsA","98304:tYDPsAK","98304:YDPsAKQ","98304:DPsAKQw","98304:PsAKQwv","98304:sAKQwvy","98304:AKQwvyt","98304:KQwvyt+","98304:Qwvyt+z","98304:wvyt+zR","98304:vyt+zRk","98304:yt+zRks","98304:t+zRksV","98304:+zRksVw","98304:zRksVwX","98304:RksVwX4","98304:ksVwX4V","98304:sVwX4Vc","98304:VwX4VcL","98304:wX4VcLw","98304:X4VcLwU","49152:aLEXHv9","49152:LEXHv9m","49152:EXHv9mt","49152:XHv9mtm","49152:Hv9mtmR","49152:v9mtmRk","49152:9mtmRkp","49152:mtmRkpX","49152:tmRkpXL"],"imphash":"d42595b695fc008ef2c56aabd8efd68e"},"file_info":{"file_name":"quis.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":3979120,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1786175145000,"last_seen":1786178339000,"last_multi_scan":1786178339000}},"detections":{"summary":{"verdict":"malicious","score":87,"tags":["malicious","evasive"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":78},"sandbox_signatures":{"informative_count":177,"suspicious_count":17,"malicious_count":4,"total":198},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Kryptik.WR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Loader.vm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping multiple times"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Able to retrieve browser cookies using SQL"},{"type":"suspicious","value":"Attempts to obtain browser cookies (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"References to WMI query strings used to retrieve disk information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"suspicious","value":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"quis.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"quis.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"quis.exe\")\n Found reference to API \"NtAllocateVirtualMemory\" (Indicator: \"AllocateVirtualMemory\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"quis.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"quis.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"quis.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"quis.exe\" queried SystemProcessInformation at 00000000-00002372-00000C15-3427891639 [PID: 2372]\n \"quis.exe\" queried SystemProcessInformation at 00000000-00002372-00000C15-3427899503 [PID: 2372]\n \"quis.exe\" queried SystemProcessInformation at 00000000-00002372-00000C15-3427999894 [PID: 2372]\n \"quis.exe\" queried SystemProcessInformation at 00000000-00002372-00000C15-3428008122 [PID: 2372]\n \"quis.exe\" queried SystemProcessInformation at 00000000-00002372-00000C15-3428173533 [PID: 2372]\n \"quis.exe\" queried SystemProcessInformation at 00000000-00002372-00000C15-3428182119 [PID: 2372]\n \"quis.exe\" queried SystemProcessInformation at 00000000-00002372-00000C15-3429206352 [PID: 2372]\n \"quis.exe\" queried SystemProcessInformation at 00000000-00002372-00000C15-3429213890 [PID: 2372]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"crypto/internal/fips140/aes.decryptBlock\" (Indicator: \".decrypt\"; File: \"quis.exe\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockGeneric\" (Indicator: \".decrypt\"; File: \"quis.exe\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockAsm\" (Indicator: \".decrypt\"; File: \"quis.exe\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlock\" (Indicator: \".decrypt\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockGeneric\" (Indicator: \".decrypt\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockAsm.abi0\" (Indicator: \".decrypt\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2e","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"ww.youtube.com/watch?v=9bZkp7q19f0\" (Indicator: \"youtube.com\"; Source: \"00000000-00002372.00000003.292710.6181C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"quis.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"quis.exe\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"quis.exe\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"quis.exe\"\n Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in file \"quis.exe\"\n Found system information discovery API: \"internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb\" in \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"quis.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002372)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"quis.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"quis.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002372)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"quis.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_DiskDrive\" (Indicator: \"select * from \"; Source: \"00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp\")\n Found string \"SELECT * FROM %s\" (Indicator: \"select * from \"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"quis.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"quis.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"quis.exe\")\n Found reference to API \"internal/syscall/windows.rtlGetVersion\" (Indicator: \"GetVersion\"; File: \"quis.exe\")\n Found reference to API \"internal/syscall/windows.rtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procRtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"quis.exe\")\n Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"quis.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"quis.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used to retrieve disk information","description":"Found string \"SELECT * FROM Win32_DiskDrive\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-514","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Smart Chain Domain in TLS SNI (bsc .blockrazor .xyz)\" (SID: 2058810, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"quis.exe\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"quis.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"syscall.GetCommandLine\" (Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found string \"syscall.procGetCommandLineW\" (Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$32","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"bsc.blockrazor.xyz\"\n \"celebration-internet.cc\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.67.72.107:443\"\n \"172.67.131.195:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_DiskDrive\" (Source: 00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp, Indicator: \"select * from win32_diskdrive\")\n \"SELECT * FROM %s\" (Source: 00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp, Indicator: \"select * from %s\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"NtOpenFile\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"CreateFile\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"NtCreateFile\"; File: \"quis.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"quis.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"quis.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"quis.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"quis.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"quis.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"quis.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"quis.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$37","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"quis.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"quis.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 7E650000\n \"quis.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 7D510000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"quis.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81510000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00ee00000040c7557efe7f0000@ntdll.dll\"\n \"22002300ee00000018c7557efe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"quis.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"quis.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"quis.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"quis.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \"quis.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \"quis.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"quis.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"quis.exe\" has an writable section named \".data\"\n \"quis.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"quis.exe\" file has an entrypoint instructions - \"jmp\t0x140071b60,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbp,mov\trbp, rsp,pushfq\t,cld\t,sub\trsp, 0xe0,mov\tqword ptr [rsp], rdi,mov\tqword ptr [rsp + 8], rsi,mov\tqword ptr [rsp + 0x10], rbp,mov\tqword ptr [rsp + 0x18], rbx,mov\tqword ptr [rsp + 0x20], r12,mov\tqword ptr [rsp + 0x28], r13,mov\tqword ptr [rsp + 0x30], r14,mov\tqword ptr [rsp + 0x38], r15,movups\txmmword ptr [rsp + 0x40], xmm6,movups\txmmword ptr [rsp + 0x50], xmm7,movups\txmmword ptr [rsp + 0x60], xmm8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x16f800\" greater than 0x100000\n Raw size of \".rdata\" is \"0x208600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x16f691\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x208498\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"quis.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"2DGRZ8EbqXTfuzWKBDHL/HpwGO9Ws7k-gl9aikN_N/WiTS-8LQoAirsy72rFgz/0Uhncps9tWAp1Q-hnhwP\"\" (Indicator: \"Go build ID: \"2DGRZ8EbqXTfuzWKBDHL/HpwGO9Ws7k-gl9aikN_N/WiTS-8LQoAirsy72rFgz/0Uhncps9tWAp1Q-hnhwP\")\" in Source: quis.exe, \"Go build ID: \"2DGRZ8EbqXTfuzWKBDHL/HpwGO9Ws7k-gl9aikN_N/WiTS-8LQoAirsy72rFgz/0Uhncps9tWAp1Q-hnhwP\"\" (Indicator: \"Go build ID: \"2DGRZ8EbqXTfuzWKBDHL/HpwGO9Ws7k-gl9aikN_N/WiTS-8LQoAirsy72rFgz/0Uhncps9tWAp1Q-hnhwP\")\" in Source: 00000000-00002372.00000001.285284.6C8E1000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bsc.blockrazor.xyz\"\n \"celebration-internet.cc\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"quis.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"quis.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"quis.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"quis.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"quis.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 471817)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$3a","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"quis.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"quis.exe\" queries basic process information of the \"C:\\quis.exe\" (UID: 2372)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"quis.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002372)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Possibly tries to evade analysis by sleeping multiple times\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"quis.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"quis.exe\" trying to touch file \"C:\\quis.exe\"\n \"quis.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"quis.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"quis.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"quis.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"quis.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"quis.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"quis.exe\" trying to touch file \"C:\\MSVCP140.DLL\"\n \"quis.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"quis.exe\" trying to touch file \"C:\\VCRUNTIME140.DLL\"\n \"quis.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"quis.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"quis.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"quis.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"quis.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"quis.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"quis.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"quis.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"quis.exe\")\n Found reference to API \"SetsockoptIPMreq\" (Indicator: \"setsockopt\"; File: \"quis.exe\")\n Found reference to API \"SetsockoptLinger\" (Indicator: \"setsockopt\"; File: \"quis.exe\")\n Found reference to API \"SetsockoptIPv6Mreq\" (Indicator: \"setsockopt\"; File: \"quis.exe\")\n Found reference to API \"SetsockoptInet4Addr\" (Indicator: \"setsockopt\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"setsockopt\"; File: \"quis.exe\")\n Found reference to API \"syscall.Setsockopt\" (Indicator: \"setsockopt\"; File: \"quis.exe\")\n Found reference to API \"syscall.SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"quis.exe\")\n Found reference to API \"syscall.Setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"syscall.procsetsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"quis.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: 2f\" - (UID: 00000000-00002372)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"quis.exe\" called \"InternetReadFile\" with parameter 8192 (UID: 00000000-00002372)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"quis.exe\" called \"InternetOpenA\" (UID: 00000000-00002372)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"WSASend\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"quis.exe\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"quis.exe\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"quis.exe\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"syscall.procWSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"syscall.procWSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"CreateNamedPipe\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"998,3244,3237,,InternetReadFile,Wininet.dll,\"01:13:48.359\",RX=0,PX=0\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002372.00000001.285284.69030000.00000004.mdmp, 00000000-00002372.00000002.287205.69030000.00000004.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"quis.exe\")\n Found reference to API \"syscall.procsetsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \"wsastartup\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"wsacleanup\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"gethostbyname\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \" send \"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \" socket \"; File: \"quis.exe\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"wsastartup\"; File: \"quis.exe\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"syscall.procWSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"\n \"2.5.29.17\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n \"2.5.29.32\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.15\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$40","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$41","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.6181C000.00000004.mdmp\")\n Found string \"Content-Length200POST / HTTP/1.1H\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002372.00000000.283362.617B0000.00000004.mdmp\")\n Found string \"Content-Length52POST / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OKO\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"bsc.blockrazor.xyz\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://go.dev\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"bsc.blockrazor.xyz\" (2 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://bsc.blockrazor.xyz/\n Found HTTPS POST request to https://celebration-internet.cc/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"bsc.blockrazor.xyz\" (90 days old)\n Short term registered certificate: \"celebration-internet.cc\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.72.107\" on port \"443\"\n HTTPS traffic to \"172.67.131.195\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$43","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00002372-00000C2C-3429148166\")\n Found string \"GetClipboardData\" (Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"quis.exe\")\n Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procRtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"quis.exe\"\n Found registry query API: \"RegEnumValue (in long string)\" in file \"quis.exe\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"quis.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"GetUserName\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountSid\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"NetGetJoinInformation\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"quis.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$44","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindNextFile\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"FindFirstFile\"; File: \"quis.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"quis.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"quis.exe\")\n Found reference to API \"syscall.GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"quis.exe\")\n Found reference to API \"syscall._GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"quis.exe\")\n Found reference to API \"syscall.GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"syscall._GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"syscall.procGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"quis.exe\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"quis.exe\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procGetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002372.00000002.287205.6CCCF000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_DiskDrive\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserDel\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"quis.exe\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in file \"quis.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"ImpersonateLoggedOnUser\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"SetInformationFile\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"NtSetInformationFile\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"ot supportedinvalid cross-device linkGetFinalPathNameByHandleWGetQueuedCompletionStatusUpdateProcThreadAttribute2910383045673370361328125goroutine profile cleanupGOMAXPROCS updater (idle)chansend: spurious wakeupruntime\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: quis.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"quis.exe\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"quis.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"quis.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"quis.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"quis.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"quis.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00002372.00000001.285284.69030000.00000004.mdmp, 00000000-00002372.00000002.287205.69030000.00000004.mdmp, 00000000-00002372.00000003.292710.69030000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"remove\" (Source: quis.exe, API is part of module: MSVCRT.DLL)\n Found string \"WSAIoctl\" (Source: quis.exe, API is part of module: WS2_32.DLL)\n Found string \"GetFileType\" (Source: quis.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetFileInformationByHandle\" (Source: quis.exe, API is part of module: KERNELBASE.DLL)\n Found string \"timeEndPeriod\" (Source: quis.exe, API is part of module: WINMM.DLL)\n Found string \"NtCancelWaitCompletionPacket\" (Source: quis.exe, API is part of module: NTDLL.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"quis.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_DiskDrive\" (Indicator: \" win32_diskdrive\"; Source: \"00000000-00002372.00000000.283362.617B0000.00000004.mdmp, 00000000-00002372.00000001.285284.617B0000.00000004.mdmp, 00000000-00002372.00000002.287205.617B0000.00000004.mdmp, 00000000-00002372.00000003.292710.617B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping multiple times","description":"\"quis.exe\" (Thread ID: 3244) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$4a","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.72.107 on port 443 is sent without HTTP header\n TCP traffic to 172.67.131.195 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"quis.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00002372.00000003.292710.00180000.00000004.mdmp, 00000000-00002372.00000003.292710.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-692","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser cookies (file access)","description":"\"quis.exe\" attempting to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"quis.exe\" attempting to open a file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"","origin":"API Call","mitre_attack_id":"T1539","relevance":10,"id":"api-301","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"quis.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"quis.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualAlloc\n GetSystemInfo\n WriteFile\n GetProcAddress\n CreateThread\n GetThreadContext\n LoadLibraryExW\n LoadLibraryW\n GetSystemDirectoryA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"quis.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"blockrazor.xyz\" has been identified as malicious\n Contacted Domain: \"celebration-internet.cc\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST / HTTP/1.1\nAuthorization: 824c6b4d-4f01-4e22-a500-c7d239e10480\nContent-Type: application/x-www-form-urlencoded\nHost: celebration-internet.cc\nContent-Length: 52\nCache-Control: no-cache\" with payload:==> \"method=refresh&guid=9C9DB77D37251689D518551CEF31C022\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":69,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["malicious","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a76eb224e47cfee7104e1c9","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":87,"malware_family":"W64.Evo","submit_name":"quis.exe","analysis_start_time":"2026-08-08T08:39:00+00:00","indicators_count":{"informative":177,"suspicious":32,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.67.72.107","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"address":"172.67.131.195","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]}],"dns_resolutions":[{"domain":"bsc.blockrazor.xyz","address":"172.67.72.107","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"domain":"celebration-internet.cc","address":"172.67.131.195","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]}],"http_requests":[{"host":"bsc.blockrazor.xyz","host_ip":"172.67.72.107:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nContent-Type: application/json\nHost: bsc.blockrazor.xyz\nContent-Length: 200\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}],"processes":[{"pid":2372,"ppid":0,"name":"quis.exe","command_line":"","sha256":"5c047137f0216fadb95aaf302809eb0ac2f3db0c36729152c1351fb821d94fca","normalized_path":"C:\\quis.exe","uid":"00000000-00002372","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["gdi32.dll","cryptsp.dll","wbemsvc.dll","winnsi.dll","msvcp_win.dll","advapi32.dll","ucrtbase.dll","shlwapi.dll","wininet.dll","sechost.dll","FWPUCLNT.DLL","ntdll.dll","vcruntime140_1.dll","msvcrt.dll","winmmbase.dll","powrprof.dll","mswsock.dll","rasadhlp.dll","kernel.appcore.dll","wbemprox.dll","bcrypt.dll","wintrust.dll","ws2_32.dll","fltLib.dll","vcruntime140.dll","ntasn1.dll","winmm.dll","imm32.dll","cfgmgr32.dll","OnDemandConnRouteHelper.dll","schannel.dll","crypt32.dll","ncryptsslp.dll","user32.dll","bcryptprimitives.dll","ole32.dll","windows.storage.dll","IPHLPAPI.DLL","cryptbase.dll","combase.dll","mskeyprotect.dll","KernelBase.dll","fastprox.dll","SHCore.dll","msIso.dll","dnsapi.dll","ncrypt.dll","apphelp.dll","gdi32full.dll","iertutil.dll","profapi.dll","nsi.dll","dpapi.dll","urlmon.dll","msasn1.dll","rsaenh.dll","cryptnet.dll","VxSSL64.dll","oleaut32.dll","clbcatq.dll","winhttp.dll","imagehlp.dll","gpapi.dll","rpcrt4.dll","msvcp140.dll","wbemcomn.dll","sspicli.dll","kernel32.dll","win32u.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\update-S-2-5-26-24247216-2331352693-3112950123","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2372:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"Local\\SM0:2372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"SM0:2372:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"update-S-2-5-26-24247216-2331352693-3112950123","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"SM0:2372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a76eb224e47cfee7104e1c9"}]}]}},"report_ids":{"sandbox_job_ids":["6a76eb224e47cfee7104e1c9"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample 5c047137f021… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5c047137f021…. Malware family: Win/malicious_confidence_90%. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5c047137f0216fadb95aaf302809eb0ac2f3db0c36729152c1351fb821d94fca"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample 5c047137f021… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5c047137f021…. Malware family: Win/malicious_confidence_90%. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5c047137f0216fadb95aaf302809eb0ac2f3db0c36729152c1351fb821d94fca"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample 5c047137f021… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5c047137f021…. Malware family: Win/malicious_confidence_90%. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4d","11",{}]]