34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 5c:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T46e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious RAT Sample b7cd215e4c0b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b7cd215e4c0b…. Malware family: RAT. Threat score 100/100. 18/25 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","keywords":["Malicious","RAT","malware analysis","sandbox report","threat intelligence","b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22"],"about":{"@type":"SoftwareApplication","name":"hoiquantv5.vip.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"RAT","antivirusDetections":{"malicious":18,"total":25},"behavioralIndicators":{"malicious":15,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T91b,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "WriteBoolean" (Indicator: "write"; Source: "sample.bin"), Found reference to API "get_IsConnected" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "CreateDecryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "ReadString" (Indicator: "read"; Source: "sample.bin"), Found reference to API "CloseMutex" (Indicator: "close"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "WriteUInt64" (Indicator: "write"; Source: "sample.bin"), Found reference to API "CreateMutex" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "AsyncCallback" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "WriteTools" (Indicator: "write"; Source: "sample.bin"), Found reference to API "Reconnect" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "CreateSubKey" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "System.Net.Security" (Indicator: "security"; Source: "sample.bin"), Found reference to API "ReadTools" (Indicator: "read"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=6" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "SetThreadExecutionState" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SetThreadExecutionState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "ReadAllBytes" (Indicator: "read"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "WriteSingle" (Indicator: "write"; Source: "sample.bin"), Found reference to API "System.Security.Cryptography.X509Certificates" (Indicator: "security"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "RuntimeTypeHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "WriteNull" (Indicator: "write"; Source: "sample.bin")37:T6fa,Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "sample.bin"), Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "sample.bin"), Found string "aes256" (Indicator: "aes"; Source: "sample.bin"), Found string "aes256" (Indicator: "aes256"; Source: "sample.bin"), Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "sample.bin"), Found string "GZipStream" (Indicator: "GzipStream"; Source: "sample.bin"), Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "sample.bin"), Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "sample.bin"), Found string "Aes256" (Indicator: "aes"; Source: "sample.bin"), Found string "Aes256" (Indicator: "aes256"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "sample.bin"), Found string "AesCryptoServiceProvider" (Indicator: "aes"; Source: "sample.bin"), Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "sample.bin"), Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "sample.bin"), file/memory contains long string with (Indicator: "aes"; Source: "sample.bin"), Found string "CryptoStream" (Indicator: "cryptostream"; Source: "sample.bin")38:T618,Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "sample.bin"), Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "sample.bin"), Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "sample.bin"), Found reference to "Aes256" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "sample.bin"), Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "sample.bin"), Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "sample.bin"), Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "sample.bin"), Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "sample.bin"), Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; Source: "sample.bin"), Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "sample.bin"), Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "sample.bin")39:T6a1,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM")3a:Ta8a,"hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1593330736 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1593337566 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1593517630 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1593524297 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1595883871 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1595890365 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1630267552 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1630274610 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631586018 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631594328 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631623195 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631630292 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631661572 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631668453 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631670902 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631677537 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631682587 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631689373 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631708304 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631715245 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631720802 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631727406 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631731265 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631738638 [PID: 5460] "hoiquantv5.vip.exe" queried SystemProcessInformation at 00000000-00005460-00000C15-1631739835 [PID: 5460]3b:T7a1,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to encrypt data using RSA (Dotnet String) Matched sigs: Contains ability to decrypt data using RSA (Dotnet String) Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains symmetric decryption functionality in .NET code3c:T4cf,"hoiquantv5.vip.exe" called "IsWow64Process" with parameter "5460" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "984" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "1324" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "2256" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "2360" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "6428" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "2948" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "1764" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "1368" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "776" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "5896" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "2412" - (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "IsWow64Process" with parameter "1952" - (UID: 00000000-00005460)3d:T1640,"hoiquantv5.vip.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000b300be602f77a0a57175be602f770000000000000000000000000d00000000000000090000000d000000000000000900000078a1da00d4dcb300db3d1b76501b2976af3d1b763a3e5d370d000000000000000900000000000000b9b0307710a5717530ddb300d01f1e760632c941feffffff04ddb3000900000080be2a75a0a57175f4dcb30091be2a75090000000000000040ddb3003b3c1b76090000000000000068db6975000000009d1a1b76841a1b76ae3f5d3768db697592000000a0a5717500000000c04186753cddb300b8ddb300d01f1e76462dc941feffffff4cddb300101a1b76d04186755cddb300e52f7f75e099bd75d041867568ddb300 (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005460) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003908) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008532) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008532) "cmd.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008532) "hoiquantv5.vip.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000ef00be602f77a0a57175be602f770000000000000000000000000d00000000000000090000000d0000000000000009000000e8060e0164dcef00db3d1b76501b2976af3d1b76945172300d000000000000000900000000000000b9b0307710a57175c0dcef00d01f1e76185dba46feffffff94dcef000900000080be2a75a0a5717584dcef0091be2a750900000000000000d0dcef003b3c1b76090000000000000068db6975000000009d1a1b76841a1b762051723068db697592000000a0a5717500000000c0418675ccdcef0048ddef00d01f1e765842ba46feffffffdcdcef00101a1b76d0418675ecdcef00e52f7f75e099bd75d0418675f8dcef00 (UID: 00000000-00001604)3e:T63c,"hoiquantv5.vip.exe" called "GetVersionExA" (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000000000000000b8000200000000000000030000000000b800c401b800000000000c0000009c0ab800000000000000d500980ab8000000000074edb300be602f7700000000be602f7700000000000000000c00000059d6537174f3de008cedb300282375740000d500000000000c00000008326b7198edb3002f996b710c000000 (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000000000000000b8000200000000000000030000000000b800c401b800000000000c0000009c0ab800000000000000d500980ab80020dadf0034eeb300be602f7700000000be602f7700000000000000000c000000dc99666820dadf004ceeb300282375740000d500000000000c00000030a56b7158eeb3002f996b710c000000 (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a00000200000000000000000000000000b8000200000000000000030000000000b800c401b800000000000c0000009c0ab800000000000000d500980ab800b004db0048edb300be602f7700000000be602f7700000000000000000c00000059d6537160edb300282375740000d500000000000c00000008326b716cedb3002f996b710c000000 (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000000000000000b8000200000000000000030000000000b800c401b800000000000c0000009c0ab800000000000000d500980ab8007053e100fcedb300be602f7700000000be602f7700000000000000000c000000dc9966687053e10014eeb300282375740000d500000000000c00000030a56b7120eeb3002f996b710c000000 (UID: 00000000-00005460)3f:Ta7b,"hoiquantv5.vip.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter bcrypt (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00001604)40:T3a0b,"hoiquantv5.vip.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceEx (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptFindOIDInfo (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptFindOIDInfoW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptDecodeObject (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptDecodeObjectW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter BCryptGetPropertyW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005460) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005460) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003908) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003908) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003908) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008532) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001604) "hoiquantv5.vip.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001604)41:T4e1,"Software\\" in Source: 6000045-cctor "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00001604.00000000.186282.01080000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00001604.00000000.186282.01080000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001604.00000000.186282.02DA0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001604.00000000.186282.02DA0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00005460.00000000.183420.00D50000.00000004.mdmp 00000000-00005460.00000001.185341.00D50000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00005460.00000000.183420.00D50000.00000004.mdmp 00000000-00005460.00000001.185341.00D50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005460.00000000.183420.02B40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005460.00000000.183420.02B40000.00000004.mdmp42:T854,Process hoiquantv5.vip.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5460:168:WilStaging_02" Process hoiquantv5.vip.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process hoiquantv5.vip.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5460:168:WilStaging_02" Process hoiquantv5.vip.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5460:64:WilError_03" Process hoiquantv5.vip.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5460:64:WilError_03" Process hoiquantv5.vip.exe created mutex with name "Local\SM0:5460:168:WilStaging_02" Process hoiquantv5.vip.exe created mutex with name "SM0:5460:64:WilError_03" Process hoiquantv5.vip.exe created mutex with name "SM0:5460:168:WilStaging_02" Process hoiquantv5.vip.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process hoiquantv5.vip.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3908:168:WilStaging_02" Process cmd.exe created mutex with name "SM0:3908:168:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8532:168:WilStaging_02" Process cmd.exe created mutex with name "SM0:8532:168:WilStaging_02" Process schtasks.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1248:168:WilStaging_02" Process schtasks.exe created mutex with name "SM0:1248:168:WilStaging_02" Process hoiquantv5.vip.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1604:168:WilStaging_02" Process hoiquantv5.vip.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1604:168:WilStaging_02" Process hoiquantv5.vip.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1604:64:WilError_03" Process hoiquantv5.vip.exe created mutex with name "Local\SM0:1604:168:WilStaging_02" Process hoiquantv5.vip.exe created mutex with name "SM0:1604:168:WilStaging_02" Process hoiquantv5.vip.exe created mutex with name "SM0:1604:64:WilError_03"43:T57d,"SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00001604.00000000.186282.01080000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00001604.00000000.186282.01080000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001604.00000000.186282.02DA0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001604.00000000.186282.02DA0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00005460.00000000.183420.00D50000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00005460.00000000.183420.00D50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005460.00000000.183420.02B40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005460.00000000.183420.02B40000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00005460.00000001.185341.00D50000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00005460.00000001.185341.00D50000.00000004.mdmp44:T6683,"GET /favicon?url=cagesideseats.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 11 Nov 2026 20:57:25 GMT X-Msedge-Ref: Ref A: F19A38E91FF243A7B573FD8372BB6339 Ref B: BY1AA1072320025 Ref C: 2026-11-11T20:57:25Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: F19A38E91FF243A7B573FD8372BB6339 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000W_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-99QSK Ref C: 2026-11-11T20:57:25Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=ringsidenews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 11 Nov 2026 20:57:25 GMT X-Msedge-Ref: Ref A: 79E902C611E146F5A3DD3C21A5D53889 Ref B: BY1AA1072320025 Ref C: 2026-11-11T20:57:25Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 79E902C611E146F5A3DD3C21A5D53889 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000U_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-Z2WWR Ref C: 2026-11-11T20:57:25Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=thedailyoverview.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 11 Nov 2026 20:57:25 GMT X-Msedge-Ref: Ref A: FEFD566CC1C34021B464DF8E25F6ABFA Ref B: BY1AA1072320025 Ref C: 2026-11-11T20:57:25Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: FEFD566CC1C34021B464DF8E25F6ABFA Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000I_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-JD8D9 Ref C: 2026-11-11T20:57:25Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=news.lavx.hu?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 11 Nov 2026 20:57:25 GMT X-Msedge-Ref: Ref A: CB141BD029244F37B256785E4173E793 Ref B: BY1AA1072320025 Ref C: 2026-11-11T20:57:25Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: CB141BD029244F37B256785E4173E793 Ref B: SC-WUS2-36H23_AKS-GEN01-32749822-VMSS000003_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-VNXJG Ref C: 2026-11-11T20:57:25Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=notebookcheck.net?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 11 Nov 2026 20:57:25 GMT X-Msedge-Ref: Ref A: 81C09EB58E89432FB873971CF4543AD3 Ref B: BY1AA1072320025 Ref C: 2026-11-11T20:57:25Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 81C09EB58E89432FB873971CF4543AD3 Ref B: SC-WUS2-36H23_AKS-GEN02-32749822-VMSS000000_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-6Q8SM Ref C: 2026-11-11T20:57:25Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=covenantwealthadvisors.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 11 Nov 2026 20:57:25 GMT X-Msedge-Ref: Ref A: A244CCFAE2244D2EA8FCF4025360F174 Ref B: BY1AA1072320025 Ref C: 2026-11-11T20:57:25Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: A244CCFAE2244D2EA8FCF4025360F174 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000T_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-TJPRH Ref C: 2026-11-11T20:57:25Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: outlierkit.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html Date: Wed 11 Nov 2026 20:57:27 GMT Server: cloudflare Cf-Ray: a5903595fc79ebe3-SJC Vary: Accept-Encoding Content-Encoding: br Link: <./_app/immutable/assets/app.pV0Bi7gu.css>; rel="preload"; as="style"; nopush <./_app/immutable/assets/1.m_3JlwfY.css>; rel="preload"; as="style"; nopush <./_app/immutable/entry/start.Cqu8n8FZ.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/B4HdFs1i.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/DbeKSAJs.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/Cbl3X9rz.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/DIeogL5L.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/DoISZiFP.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/BNAFw5st.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/B3QqfpOu.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/CYgJF_JY.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/DKcHJCE4.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/B17Q6ahh.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/D3t4q9Uw.js>; rel="modulepreload"; nopush <./_app/immutable/entry/app.kXKraIHI.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/3WEM7Ar6.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/hbSGsm1g.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/DuH--w0f.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/CdNxhktk.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/DEX1zciY.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/CmADjAwF.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/Crgptn8c.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/mVSuZUYx.js>; rel="modulepreload"; nopush <./_app/immutable/nodes/0.OnWj9blj.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/TjtXyOL7.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/DhNT40Br.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/69_IOA4Y.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/DXvz4GMj.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/DzyN1Ppi.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/p95S82rE.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/D4syyPfY.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/BCmC8I2u.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/KRTEQy3S.js>; rel="modulepreload"; nopush <./_app/immutable/nodes/1.DzlTwQs0.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/G5wDWkCk.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/Boxu5qH3.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/DajdGNqG.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/CHa3ZgfS.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/BMjM_1QB.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/CglPxaq-.js>; rel="modulepreload"; nopush <./_app/immutable/chunks/EFBviWrJ.js>; rel="modulepreload"; nopush X-Sveltekit-Page: true Cf-Cache-Status: DYNAMIC Rndr-Id: da27ddd0-80b2-4126 Set-Cookie: __Secure-authjs.callback-url=https%3A%2F%2Foutlierkit.com; Path=/; HttpOnly; Secure; SameSite=Lax Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.clarity.ms https://accounts.google.com https://github.com https://client.crisp.chat https://*.crisp.chat https://*.paddle.com https://cdn.paddle.com https://*.profitwell.com https://public.profitwell.com https://www.googletagmanager.com https://tagmanager.google.com https://outlierkit.typeflo.io https://plausible.io https://datafa.st https://js.feedspace.io https://*.feedspace.io https://*.posthog.com https://us-assets.i.posthog.com https://scripts.refgrowcdn.com https://files.tlt-cdn.com https://*.tlt-cdn.com https://cdn.jsdelivr.net https://static.flippa.com https://*.flippa.com https://cdnjs.cloudflare.com https://js.sentry-cdn.com; script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' https://www.clarity.ms https://scripts.clarity.ms https://accounts.google.com https://github.com https://client.crisp.chat https://*.crisp.chat https://*.paddle.com https://cdn.paddle.com https://*.profitwell.com https://public.profitwell.com https://www.googletagmanager.com https://tagmanager.google.com https://outlierkit.typeflo.io https://plausible.io https://datafa.st https://js.feedspace.io https://*.feedspace.io https://*.posthog.com https://us-assets.i.posthog.com https://googleads.g.doubleclick.net https://www.googleadservices.com https://scripts.refgrowcdn.com https://files.tlt-cdn.com https://*.tlt-cdn.com https://cdn.jsdelivr.net https://static.flippa.com https://*.flippa.com https://cdnjs.cloudflare.com https://js.sentry-cdn.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://client.crisp.chat https://*.paddle.com https://outlierkit.typeflo.io https://*.feedspace.io; connect-src 'self' https://keyword-research-for-youtube.p.rapidapi.com https://*.clarity.ms https://www.clarity.ms https://accounts.google.com https://github.com https://client.crisp.chat wss://*.crisp.chat https://*.crisp.chat https://*.paddle.com https://sandbox-checkout-service.paddle.com https://*.profitwell.com https://public.profitwell.com https://www.google-analytics.com https://analytics.google.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://www.googletagmanager.com https://outlierkit.typeflo.io https://plausible.io https://datafa.st https://*.feedspace.io https://*.posthog.com https://us.i.posthog.com https://www.google.com https://googleads.g.doubleclick.net https://*.refgrowcdn.com https://refgrow.com https://*.refgrow.com https://*.tlt-cdn.com https://*.tolt.io https://*.execute-api.us-east-1.amazonaws.com https://flippa.com https://*.flippa.com https://fxo.io https://*.fxo.io https://i.ytimg.com; img-src 'self' data: https: https://*.clarity.ms https://client.crisp.chat https://image.crisp.chat https://outlierkit.typeflo.io; media-src 'self' https://static.feedspace.io https://*.feedspace.io; font-src 'self' data: https://fonts.gstatic.com https://client.crisp.chat https://outlierkit.typeflo.io; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self' http://localhost https://sandbox-buy.paddle.com; frame-src 'self' https://accounts.google.com https://github.com https://client.crisp.chat https://*.crisp.chat https://*.paddle.com https://sandbox-buy.paddle.com https://www.youtube.com https://youtube.com https://*.youtube.com https://youtu.be https://www.googletagmanager.com https://outlierkit.typeflo.io https://*.feedspace.io https://flippa.com https://*.flippa.com https://fxo.io https://*.fxo.io Etag: "1vek40z" Alt-Svc: h3=":443"; ma=86400 X-Render-Origin-Server: Render with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: koishiai.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html; charset=utf-8 Date: Wed 11 Nov 2026 20:57:27 GMT Server: cloudflare Cf-Ray: a59035978f0e1f07-SJC Vary: accept-encoding X-Frame-Options: DENY Content-Encoding: br Permissions-Policy: camera=() microphone=() geolocation=() interest-cohort=() payment=() usb=() Cross-Origin-Opener-Policy: same-origin Cf-Cache-Status: BYPASS Strict-Transport-Security: max-age=15552000; includeSubDomains Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://firestore.googleapis.com https://*.firebaseio.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qsKoHa6tnJARFxp13FoxpcMNinDAPtVmkXOsbD95YCtMKQ8vPtAI0sKL2Fu21bPNH8A%2FEtXw7rGKogOgbVYbcadpwrTetFhj2pS%2BdEmBNlc2YdXWGO2A8pTEGSR7bdw%3D"}]} Cross-Origin-Resource-Policy: same-site Cache-Control: no-store Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: miraflow.ai User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Tue 31 Mar 2026 04:56:24 GMT X-Amz-Cf-Pop: JFK52-P3 Vary: Accept-Encoding Content-Encoding: gzip Accept-Ch: Sec-CH-Prefers-Color-Scheme Via: 1.1 145a3c1a881b9a37bb761d4b0890859a.cloudfront.net (CloudFront) Last-Modified: Tue 31 Mar 2026 04:25:13 GMT Critical-Ch: Sec-CH-Prefers-Color-Scheme X-Powered-By: Next.js Payload Etag: W/"3c2e-19d42237428" X-Cache: Hit from cloudfront Cache-Control: public max-age=31536000 immutable Accept-Ranges: bytes Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: d55hsF5i9ZAr7fNAWl5nwtS5SPX1IszUw-Pow3eRGNmcVriFM_vLEg== Age: 19497662 with no response body "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: support.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Date: Wed 11 Nov 2026 20:57:27 GMT Server: support-content-ui Expires: Wed 11 Nov 2026 20:57:27 GMT X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Frame-Options: SAMEORIGIN Location: https://support.google.com/?w=32&h=32&q=100&m=6&f=webp&u=t Cache-Control: private max-age=0 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>3C48544D4C3E3C484541443E3C6D65746120687474702D65717569763D22636F6E74656E742D747970652220636F6E74656E743D22746578742F68746D6C3B63....... "GET /?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: support.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: text/html; charset=UTF-8 Date: Wed 11 Nov 2026 20:57:28 GMT Server: support-content-ui Expires: Wed 11 Nov 2026 20:57:28 GMT Content-Encoding: gzip X-Frame-Options: SAMEORIGIN P3p: CP="This is not a P3P policy! See g.co/p3phelp for more info." Strict-Transport-Security: max-age=31536000; includeSubdomains Set-Cookie: NID=CuQBCAESlgEBM9Agl0Ceyx17hXpC3eKKeq3HbHfEhrsliGC4mKc6qyz3G2qQcBlYgjAm6UpQwKv_ZF4UA7ZdEX2EuwaLlubbM6X8WmECdBwYW6b6LQcDruPPhCFnUoSGyJ0vJYTld5u5cu55K0EQtEuPLdWa_rPICifm_GDmECDkwdaeLb7UvTHW2LlLb2_g0gyJgp_SgsZo5trd_HQoATJFAXBKQs9IIYjHCIIIkCYGc2H6xOg3_zsYMa45iSELAuGyD4T7tKvVyF9-khKOAsGZXT9w1PnJbISx2TkJo4SDI1zwkXwC; expires=Thu 13-May-2027 20:57:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none X-Content-Type-Options: nosniff X-Xss-Protection: 0 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-S686b5tOI92vV79y1c1Q' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http: 'report-sample';report-uri https://csp.withgoogle.com/csp/scfe Cache-Control: private max-age=0 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: techlayers.in User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html Date: Wed 11 Nov 2026 20:57:28 GMT Server: cloudflare Cf-Ray: a59035a02d391df7-SJC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Content-Encoding: zstd X-Turbo-Charged-By: LiteSpeed Cf-Cache-Status: BYPASS Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xEj5rckDcE9bY2%2FTBbeDoRGZlxYD4WNW4nVog%2FCEQCTYdLcjyzMerx%2Fw478phuuOwwkIDItHqjLIN7HraRigERDLH8URjhdYW%2BpduFCB1%2F1HuMEKqisAwOnQihekskdb"}]} Cache-Control: private no-cache no-store must-revalidate max-age=0 Alt-Svc: h3=":443"; ma=86400 Speculation-Rules: "/cdn-cgi/speculation" Pragma: no-cache with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.bozokmedia.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Wed 11 Nov 2026 20:57:28 GMT Server: cloudflare Expires: Sun 15 Nov 2026 03:38:21 GMT Cf-Ray: a59035a40b81f99f-SJC Cf-Cache-Status: HIT Last-Modified: Sun 08 Nov 2026 02:42:06 GMT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Etag: "6aefe17e-6be" Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=VhxxJ8rFeD%2BIl%2B2IP6LpgrW2BO93%2FLl9UhuhXGHZOKvHEKbvgahvZ5DEJ5rbGFvQ9MnJQL4hw2wfkZoJylgJbj8bNRWDRSJPyh72RJDrYVRj5LKw3VIqWUYF9P8tk0U%2Bn6Gnep4%3D"}]} Cache-Control: public max-age=604800 no-transform Accept-Ranges: bytes Alt-Svc: h3=":443"; ma=86400 Age: 321546 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: gadgets.beebom.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Wed 11 Nov 2026 20:47:50 GMT X-Amz-Cf-Pop: JFK52-P6 Server: CloudFront Vary: Accept-Encoding Content-Encoding: gzip X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000 Via: 1.1 d6e8d455c6249e06c531b544b92279c0.cloudfront.net (CloudFront) Last-Modified: Thu 05 Nov 2026 11:29:41 GMT X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff Oin: a Referrer-Policy: same-origin Etag: W/"3c2e-1a1ab78c488" X-Cache: Hit from cloudfront Cache-Control: no-cache private Accept-Ranges: bytes Alt-Svc: h3=":443"; ma=86400 Age: 579 X-Amz-Cf-Id: uGaTPM3ryVVX6g3JIXPXtX14m7eJlKsO39BDW4Wv4JxoM5vV0QGtUg== with response body ==>BINARY_CONTENT.......45:Td59,"hoiquantv5.vip.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73060000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\67186481D97828A572BF5DB055F4A9F1\SYSTEM.NI.DLL" at base 72600000 "hoiquantv5.vip.exe" loaded module "ADVAPI32.DLL" at base 769f0000 "hoiquantv5.vip.exe" loaded module "SHELL32.DLL" at base 75670000 "hoiquantv5.vip.exe" loaded module "KERNEL32.DLL" at base 76370000 "hoiquantv5.vip.exe" loaded module "BCRYPT.DLL" at base 75e00000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71f50000 "hoiquantv5.vip.exe" loaded module "ADVAPI32" at base 769f0000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75c50000 "hoiquantv5.vip.exe" loaded module "CRYPT32.DLL" at base 75fc0000 "hoiquantv5.vip.exe" loaded module "BCRYPT" at base 75e00000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 716b0000 "hoiquantv5.vip.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75180000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 71690000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 71610000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 71600000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 71530000 "hoiquantv5.vip.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75180000 "hoiquantv5.vip.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 75180000 "hoiquantv5.vip.exe" loaded module "AMSI.DLL" at base 71510000 "hoiquantv5.vip.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75180000 "hoiquantv5.vip.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75180000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSWOW64\G9VU9151.DLL" at base 714a0000 "hoiquantv5.vip.exe" loaded module "PSAPI.DLL" at base 75e20000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 71420000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 71fe0000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 71360000 "hoiquantv5.vip.exe" loaded module "USER32.DLL" at base 754d0000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 70e80000 "hoiquantv5.vip.exe" loaded module "VIRTDISK.DLL" at base 70e70000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 70d90000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 70d90000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 70d10000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSWOW64\ONECORECOMMONPROXYSTUB.DLL" at base 70c40000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74fa0000 "cmd.exe" loaded module "NTDLL.DLL" at base 772b0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ee0000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74fa0000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\67186481D97828A572BF5DB055F4A9F1\SYSTEM.NI.DLL" at base 72540000 "hoiquantv5.vip.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74f1000046:Te13,"hoiquantv5.vip.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "hoiquantv5.vip.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "hoiquantv5.vip.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\INPROCSERVER32") "hoiquantv5.vip.exe" touched "Windows Management and Instrumentation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "hoiquantv5.vip.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "hoiquantv5.vip.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "hoiquantv5.vip.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "hoiquantv5.vip.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "hoiquantv5.vip.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "hoiquantv5.vip.exe" touched "CLSID_SearchHome" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "hoiquantv5.vip.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "hoiquantv5.vip.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "hoiquantv5.vip.exe" touched "Other Users Folder" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "hoiquantv5.vip.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "hoiquantv5.vip.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "hoiquantv5.vip.exe" touched "StreamBackedFolder" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "hoiquantv5.vip.exe" touched "Computers and Devices" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "hoiquantv5.vip.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "hoiquantv5.vip.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "hoiquantv5.vip.exe" touched "Property System Both Class Factory" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER32") "hoiquantv5.vip.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCSERVER32") "hoiquantv5.vip.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCHANDLER") "hoiquantv5.vip.exe" touched "Start Menu Cache" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\INPROCSERVER32")47:T48f,"hoiquantv5.vip.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"48:T5f6,Process "hoiquantv5.vip.exe" (UID: 00000000-00001604) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="E9zD9nYg8OZOCcP", PROMPT="$P$G", SESSIONNAME="Console", PROCESSOR_ARCHITECTURE="x86", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", SystemDrive="C:", OneDrive="%USERPROFILE%\OneDrive", USERNAME="QLn5rWG", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", Path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;%NVM_SYMLINK%;%WINDIR%\System32\OpenSSH\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\;C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmproxy\bin", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", PROCESSOR_ARCHITEW6432="AMD64", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\QLn5rWG", TMP="%LOCALAPPDATA%\Temp", ProgramFiles="%PROGRAMFILES%\(x86)", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="8", windir="C:\WINDOWS""49:T491,Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll" [Source: 00000000-00005460-00000C2B-1595788681] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005460-00000C2B-1596075437] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00005460-00000C2B-1630205678] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" [Source: 00000000-00005460-00000C2B-1630366091] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00005460-00000C2B-1630730303] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005460-00000C2B-1631475789] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005460-00000C2B-1631534306]4a:T9ed,Spawned process "cmd.exe" with commandline "/c schtasks /create /f /sc onlogon /rl highest /tn "hoiquantv5.v ..." (UID: 00000000-00003908), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\tmp437B.tmp.bat""" (UID: 00000000-00008532), Spawned process "schtasks.exe" with commandline "schtasks /create /f /sc onlogon /rl highest /tn "hoiquantv5.vip ..." (UID: 00000000-00001248) Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00000000-00007588) Spawned process "hoiquantv5.vip.exe" (UID: 00000000-00001604) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002300) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00001140), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00003352), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005104), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00008328), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00004012), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00005440), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007512), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007316), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00004540), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00008584), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00008120), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00008500), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00004404)4b:T9ed,Spawned process "cmd.exe" with commandline "/c schtasks /create /f /sc onlogon /rl highest /tn "hoiquantv5.v ..." (UID: 00000000-00003908), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\tmp437B.tmp.bat""" (UID: 00000000-00008532), Spawned process "schtasks.exe" with commandline "schtasks /create /f /sc onlogon /rl highest /tn "hoiquantv5.vip ..." (UID: 00000000-00001248) Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00000000-00007588) Spawned process "hoiquantv5.vip.exe" (UID: 00000000-00001604) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002300) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00001140), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00003352), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005104), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00008328), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00004012), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00005440), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007512), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007316), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00004540), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00008584), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00008120), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00008500), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00004404)4c:Tf0d,The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 76:7A:3B:FA:D0:F8:92:94:22:AC:46:9B:F5:92:44:E3:9B:62:43:32; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 9C:FF:31:B5:1D:22:B9:BF:D3:80:8A:8C:35:B4:BB:DF:36:13:71:F0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M01, O=Amazon, C=US" (SHA1: 66:33:AB:6B:A1:F4:BA:F0:6E:AE:77:5E:14:E2:77:D7:EA:5F:1F:A5; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: 2A:D9:74:A7:75:F7:3C:BD:BB:D8:F5:AC:3A:49:25:5F:A8:FB:1F:8C; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 45:C5:9B:8B:ED:FA:11:82:8D:14:34:97:23:A4:30:17:49:24:D9:E5; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M01, O=Amazon, C=US" (SHA1: E3:7B:D0:02:F6:16:9A:BF:B0:3F:6B:EF:41:E8:A7:1D:A3:E0:6E:60; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: AD:9E:66:2F:CD:F6:AE:D3:F6:2E:7B:6E:96:78:CE:38:D0:EC:03:ED; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 02, O=Microsoft Corporation, C=US" (SHA1: 20:68:99:D7:5C:1F:E1:8F:14:28:B6:96:30:2F:F8:D4:78:01:64:46; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: F8:A4:08:B8:FB:EE:A0:77:B7:57:38:65:86:41:BE:77:15:47:20:EB; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: E7:26:0D:F0:1C:8D:4A:F7:5D:16:41:FB:C8:4E:3A:04:86:AD:99:8A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: E7:B8:B5:A6:74:3C:E1:B2:F1:7B:04:1D:E5:95:58:A4:14:72:D7:0C; see report for more information)4d:T77b,"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: outlierkit.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: koishiai.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: techlayers.in User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image"4e:Ta76,"hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCHANDLER32"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCHANDLER"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCHANDLER32"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\ELEVATION"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\TREATAS"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C2F03A33-21F5-47FA-B4BB-156362A2F239}"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\INPROCHANDLER32"; Key: ""; Value: "")4f:Te17,"hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "382B5E24-181E-417F-A8D6-2155F749E724"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ENABLESHELLEXECUTEHOOKS"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C2F03A33-21F5-47FA-B4BB-156362A2F239}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6D5140C1-7436-11CE-8034-00AA006009FA}\PROXYSTUBCLSID32"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}"; Key: "APPID"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\INPROCSERVER32"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "HOIQUANTV5.VIP.EXE"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "hoiquantv5.vip.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "")50:T588,"hoiquantv5.vip.exe" trying to touch file "C:\Windows\System32\wow64log.dll" "hoiquantv5.vip.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "hoiquantv5.vip.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "hoiquantv5.vip.exe" trying to touch file "C:\WINDOWS\SysWOW64\MSCOREE.DLL" "hoiquantv5.vip.exe" trying to touch file "\Device\KsecDD" "hoiquantv5.vip.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "hoiquantv5.vip.exe" trying to touch file "C:\WINDOWS\SysWOW64\MSCOREE.DLL.local" "hoiquantv5.vip.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "hoiquantv5.vip.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "hoiquantv5.vip.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "hoiquantv5.vip.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "hoiquantv5.vip.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "hoiquantv5.vip.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "hoiquantv5.vip.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "hoiquantv5.vip.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "hoiquantv5.vip.exe" trying to touch file "C:\hoiquantv5.vip.exe.config"51:T8a5,"hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\System32\wow64log.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\45cef8929f7918524d50f1f75c04b1c3\mscorlib.ni.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\45cef8929f7918524d50f1f75c04b1c3\mscorlib.ni.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\45cef8929f7918524d50f1f75c04b1c3\mscorlib.ni.exe" "hoiquantv5.vip.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\45cef8929f7918524d50f1f75c04b1c3\mscorlib.ni.exe" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\SysWOW64\rpcss.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll"52:T50e,"hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "hoiquantv5.vip.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\MSCOREE.DLL.local" "hoiquantv5.vip.exe" trying to access non-existent file "C:\hoiquantv5.vip.exe.config" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\hoiquantv5.vip" "hoiquantv5.vip.exe" trying to access non-existent file "C:\hoiquantv5.vip.INI" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PublisherPolicy.tme" "hoiquantv5.vip.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Crypto\OIDInfo" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\PROPSYS.dll.mui" "hoiquantv5.vip.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\cmd.exe.mui" "cmd.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\cmd.exe.mui" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\tmp437B.tmp.bat"53:T422,Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "hoiquantv5.vip.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveBufferSize" in "hoiquantv5.vip.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_SendBufferSize" in "hoiquantv5.vip.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "hoiquantv5.vip.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "hoiquantv5.vip.exe" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference ".ctor" in "hoiquantv5.vip.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_RemoteEndPoint" in "hoiquantv5.vip.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Dispose" in "hoiquantv5.vip.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Poll" in "hoiquantv5.vip.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "hoiquantv5.vip.exe"54:T2387,GET /favicon?url=cagesideseats.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=ringsidenews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=thedailyoverview.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=news.lavx.hu?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=notebookcheck.net?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=covenantwealthadvisors.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: outlierkit.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: koishiai.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: miraflow.ai User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: support.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: support.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: techlayers.in User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.bozokmedia.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: gadgets.beebom.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image 55:T5bd,Found HTTPS GET request to https://services.bingapis.com/favicon?url=cagesideseats.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=ringsidenews.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=thedailyoverview.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=news.lavx.hu?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=notebookcheck.net?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=covenantwealthadvisors.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://outlierkit.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://koishiai.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://miraflow.ai/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://support.google.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://support.google.com/?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://techlayers.in/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.bozokmedia.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://gadgets.beebom.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t56:T636,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001604.00000000.186282.01080000.00000004.mdmp, 00000000-00001604.00000000.186282.012E0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001604.00000000.186282.01080000.00000004.mdmp, 00000000-00001604.00000000.186282.012E0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005460.00000000.183420.00D50000.00000004.mdmp, 00000000-00005460.00000000.183420.00F80000.00000004.mdmp, 00000000-00005460.00000000.183420.01090000.00000004.mdmp, 00000000-00005460.00000001.185341.00D50000.00000004.mdmp, 00000000-00005460.00000001.185341.00F80000.00000004.mdmp, 00000000-00005460.00000001.185341.01090000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005460.00000000.183420.00D50000.00000004.mdmp, 00000000-00005460.00000000.183420.00F80000.00000004.mdmp, 00000000-00005460.00000000.183420.01090000.00000004.mdmp, 00000000-00005460.00000001.185341.00D50000.00000004.mdmp, 00000000-00005460.00000001.185341.00F80000.00000004.mdmp, 00000000-00005460.00000001.185341.01090000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005460.00000000.183420.00D50000.00000004.mdmp, 00000000-00005460.00000001.185341.00D50000.00000004.mdmp")57:T5b9,Client.Connection.ClientSocket::get_IsConnected() at 0a5bcce32b404a33b7f52fa2b3c31336-6000001-Program~Main System.Net.Sockets.Socket::set_ReceiveBufferSize(System.Int32) at 0a5bcce32b404a33b7f52fa2b3c31336-600001b-ClientSocket~InitializeClient Client.Connection.ClientSocket::get_SslClient() at 0a5bcce32b404a33b7f52fa2b3c31336-600001e-ClientSocket~Reconnect Client.Connection.ClientSocket::get_TcpClient() at 0a5bcce32b404a33b7f52fa2b3c31336-600001f-ClientSocket~ReadServertData Client.Connection.ClientSocket::get_SendSync() at 0a5bcce32b404a33b7f52fa2b3c31336-6000020-ClientSocket~Send Client.Connection.ClientSocket::Send(System.Byte[]) at 0a5bcce32b404a33b7f52fa2b3c31336-6000021-ClientSocket~KeepAlivePacket Client.Connection.ClientSocket::get_ActivatePong() at 0a5bcce32b404a33b7f52fa2b3c31336-6000022-ClientSocket~Pong Client.Connection.ClientSocket::get_SslClient() at 0a5bcce32b404a33b7f52fa2b3c31336-6000031-Methods~ClientOnExit Client.Connection.ClientSocket::Send(System.Byte[]) at 0a5bcce32b404a33b7f52fa2b3c31336-6000046-Packet~Read Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String) at 0a5bcce32b404a33b7f52fa2b3c31336-6000047-Packet~Invoke Client.Connection.ClientSocket::Send(System.Byte[]) at 0a5bcce32b404a33b7f52fa2b3c31336-6000048-Packet~Received Client.Connection.ClientSocket::Send(System.Byte[]) at 0a5bcce32b404a33b7f52fa2b3c31336-6000049-Packet~Error58:Tc87,Process "%APPDATA%\hoiquantv5.vip.exe" connects to 104.18.21.246 on port 443 (TCP); Domain: "hoiquantv5.vip" Process "%APPDATA%\hoiquantv5.vip.exe" connects to 104.18.21.246 on port 6606 (TCP); Domain: "hoiquantv5.vip" Process "%APPDATA%\hoiquantv5.vip.exe" connects to 104.18.21.246 on port 8808 (TCP); Domain: "hoiquantv5.vip" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.11 on port 80 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 52.123.251.35 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.55.236.131 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 99.84.160.78 on port 443 (TCP); Domain: "sb.scorecardresearch.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.12 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 184.30.42.16 on port 443 (UDP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.73.13 on port 443 (TCP); Domain: "services.bingapis.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.10 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 184.30.42.18 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 18.238.49.62 on port 443 (TCP); Domain: "miraflow.ai" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 104.21.70.97 on port 443 (TCP); Domain: "outlierkit.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.67.209.100 on port 443 (TCP); Domain: "koishiai.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.251.45.174 on port 443 (UDP); Domain: "support.google.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 104.21.38.187 on port 443 (TCP); Domain: "techlayers.in" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 104.21.45.231 on port 443 (TCP); Domain: "www.bozokmedia.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 3.168.102.60 on port 443 (TCP); Domain: "gadgets.beebom.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.10 on port 443 (TCP); Domain: "r.msftstatic.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.110.7 on port 443 (TCP); Domain: "edge-consumer-static.azureedge.net" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.251.41.174 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.250.65.65 on port 443 (TCP); Domain: "clients2.googleusercontent.com"59:T698,Spawned process "hoiquantv5.vip.exe" (UID: 00000000-00005460) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /sc onlogon /rl highest /tn "hoiquantv5.vip" /tr '"%APPDATA%\\hoiquantv5.vip.exe"' & exit" (UID: 00000000-00003908) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\tmp437B.tmp.bat""" (UID: 00000000-00008532) Spawned process "schtasks.exe" with commandline "schtasks /create /f /sc onlogon /rl highest /tn "hoiquantv5.vip" /tr '"%APPDATA%\\hoiquantv5.vip.exe"'" (UID: 00000000-00001248) Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00000000-00007588) Spawned process "hoiquantv5.vip.exe" (UID: 00000000-00001604) Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6688,i,16254218155976895502,13441484918623894912,524288 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6704 /prefetch:8" (UID: 00000000-00004540) Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6688,i,16254218155976895502,13441484918623894912,524288 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6704 /prefetch:8" (UID: 00000000-00008584)5a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3cAAAAAAAAAAAAAAAAHd3d3cAAAAAAAAAAAAAAAd4d3+HcAAAAAAAAAAAAAAHd4iI+HcAAAAAAAAAAAAAB4iP+HiHcAAAAAAAAAAAAAiIj/d4+HAABAAAAAAAAAAAiHeIiI92cARgAAAAAAAAAAh4iIiHd3cAYAAAAAAAAAAAeIiHd3d3cAYAAAAAAAAAAAd3d3d3d3cAYAAAAAAAAAd3d3d3d3d3cAYAAAAAAAAHd3d3d3d3d3cEYAAAAAAAAHd3d3d3d3d3cEYAAAAAAAAHd3d3d3d3d3YEYAAAAAAAAHd3d3d3iId3YEYAAAAAAAAHd3d3iIiId3YEYAAAAAAAAHd3iIiIiId3YGAAAAAAAAAHdHiIiIiId3YGAAAAAAAAAAdniIiIiId3YGAAAAAAAAAAd3iIiIiHd3YEAAAAAAAAAAd3iIiHcHd3YAAAAAAAAAAAd3iHcHd3d3QAAAAAAAAAAAd3AHd3d3d3AAAAAAAAAAAAd3d3d3d3d3AAAAAAAAAAAAd3d3d3d3dgAAAAAAAAAAAAd3d3d3ZkAAAAAAAAAAAAAAd2ZAAEAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////v////B////AP///gB///4AP//+AAH//gAA//8AAH//gAB//8AAP//AAB//gAAP/4AAB//AAAP/4AAB//AAAP/4AAB//AAAf/4AAD//gAAf/8AAD//gAAf/8AAH//gAB//8AAf//gAH//8AD///gD///8H///////////w==5b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3cAAAAAAAAAAAAAAAAHd3d3cAAAAAAAAAAAAAAAd4d3+HcAAAAAAAAAAAAAAHd4iI+HcAAAAAAAAAAAAAB4iP+HiHcAAAAAAAAAAAAAiIj/d4+HAABAAAAAAAAAAAiHeIiI92cARgAAAAAAAAAAh4iIiHd3cAYAAAAAAAAAAAeIiHd3d3cAYAAAAAAAAAAAd3d3d3d3cAYAAAAAAAAAd3d3d3d3d3cAYAAAAAAAAHd3d3d3d3d3cEYAAAAAAAAHd3d3d3d3d3cEYAAAAAAAAHd3d3d3d3d3YEYAAAAAAAAHd3d3d3iId3YEYAAAAAAAAHd3d3iIiId3YEYAAAAAAAAHd3iIiIiId3YGAAAAAAAAAHdHiIiIiId3YGAAAAAAAAAAdniIiIiId3YGAAAAAAAAAAd3iIiIiHd3YEAAAAAAAAAAd3iIiHcHd3YAAAAAAAAAAAd3iHcHd3d3QAAAAAAAAAAAd3AHd3d3d3AAAAAAAAAAAAd3d3d3d3d3AAAAAAAAAAAAd3d3d3d3dgAAAAAAAAAAAAd3d3d3ZkAAAAAAAAAAAAAAd2ZAAEAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////v////B////AP///gB///4AP//+AAH//gAA//8AAH//gAB//8AAP//AAB//gAAP/4AAB//AAAP/4AAB//AAAP/4AAB//AAAf/4AAD//gAAf/8AAD//gAAf/8AAH//gAB//8AAf//gAH//8AD///gD///8H///////////w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794430785963,"unified_at":"2026-11-11T20:59:45.963Z","metadata":{"hashes":{"sha256":"b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","sha1":"1a059d1999e6e9cc9e3e8c20a0fff3631e22e3f5","md5":"0a5bcce32b404a33b7f52fa2b3c31336","sha512":"37491966b45c68e658534a4967f067928a7b767f876cb0a3a038d45aa960f4b3a21720b8cf27f86bb3e28c66aaf7db5a20e33625d790e3e7c6c96203078cb331","ssdeep":"1536:OuisNTgsr2xt1TR363byXNwgQvk+UByd9FwevI9ux:Oui4Tgsr21l363byCNTzeJux","ssdeep_chunks":["1536:OuisNTg","1536:uisNTgs","1536:isNTgsr","1536:sNTgsr2","1536:NTgsr2x","1536:Tgsr2xt","1536:gsr2xt1","1536:sr2xt1T","1536:r2xt1TR","1536:2xt1TR3","1536:xt1TR36","1536:t1TR363","1536:1TR363b","1536:TR363by","1536:R363byX","1536:363byXN","1536:63byXNw","1536:3byXNwg","1536:byXNwgQ","1536:yXNwgQv","1536:XNwgQvk","1536:NwgQvk+","1536:wgQvk+U","1536:gQvk+UB","1536:Qvk+UBy","1536:vk+UByd","1536:k+UByd9","1536:+UByd9F","1536:UByd9Fw","1536:Byd9Fwe","1536:yd9Fwev","1536:d9FwevI","1536:9FwevI9","1536:FwevI9u","1536:wevI9ux","3072:OuisNTg","3072:uisNTgs","3072:isNTgsr","3072:sNTgsr2","3072:NTgsr2x","3072:Tgsr2xt","3072:gsr2xt1","3072:sr2xt1T","3072:r2xt1TR","3072:2xt1TR3","3072:xt1TR36","3072:t1TR363","3072:1TR363b","3072:TR363by","3072:R363byX","3072:363byXN","3072:63byXNw","3072:3byXNwg","3072:byXNwgQ","3072:yXNwgQv","3072:XNwgQvk","3072:NwgQvk+","3072:wgQvk+U","3072:gQvk+UB","3072:Qvk+UBy","3072:vk+UByd","3072:k+UByd9","3072:+UByd9F","3072:UByd9Fw","3072:Byd9Fwe","3072:yd9Fwev","3072:d9FwevI","3072:9FwevI9","3072:FwevI9u","3072:wevI9ux","1536:Oui4Tgs","1536:ui4Tgsr","1536:i4Tgsr2","1536:4Tgsr21","1536:Tgsr21l","1536:gsr21l3","1536:sr21l36","1536:r21l363","1536:21l363b","1536:1l363by","1536:l363byC","1536:363byCN","1536:63byCNT","1536:3byCNTz","1536:byCNTze","1536:yCNTzeJ","1536:CNTzeJu","1536:NTzeJux"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"hoiquantv5.vip.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":81408,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794430464000,"last_seen":1794430464000,"last_multi_scan":1794430464000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","agent","modular","rat","opensource","criminal","asyncrat","malicious","new_domain","suspicious","evasive"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":66},"sandbox_signatures":{"informative_count":160,"suspicious_count":19,"malicious_count":15,"total":194},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.RL_Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/MSIL.Crysan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.AsyncRAT.Marte.B.04E175AA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Razy-9625918-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.AsyncRAT.Marte.B.04E175AA (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/AsyncRAT.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/MSIL.DcRat.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005c228f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/AsyncRat-B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Fareit-FZT!0A5BCCE32B40","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Samas.B.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.AsyncRAT.Win32.37163","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"RAT","sources":[{"report_type":"qsp","report_id":""}]},{"value":"AsyncRAT.Marte.B.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to gather system environment details"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Able to detect if debugger is present"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to encrypt data using RSA (Dotnet String)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to decrypt data using RSA (Dotnet String)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform crypto operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to execute applications using .NET process API"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"suspicious","value":"Recently registered domain detected"},{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"},{"type":"suspicious","value":"Application communicates to suspicious domain"},{"type":"suspicious","value":"Detected network traffic to commonly abused domain"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":".NET code is able to query registry"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Tries to access/write temporary files"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"malicious","value":"Detected multiple DNS responses with a low TTL"},{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]}],"sandbox_signatures":[{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - AsyncRAT","description":"YARA signature for AsyncRAT malware matched on file \"sample.bin\"","origin":"Static Analysis","id":"yara-6","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SetThreadExecutionState\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetTempFileName\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"RtlSetProcessIsCritical\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CheckRemoteDebuggerPresent\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Antivirus\" (Indicator: \"antivirus\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$37","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-217","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\"), Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.Encrypt\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-358","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.CreateDecryptor\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-357","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573.002","id":"string-352","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.Aes256.CreateDecryptor\" in Source: sample.bin, Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.Decrypt\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-445","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutex\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$38","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"GetActiveWindowTitle\" (Indicator: \"GetActiveWindowTitle\"; Source: \"sample.bin\"), Found reference to API \"GetActiveWindowTitle\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://sche\", Pattern match: \"mas.microsoft.com/smi/2005/windowssettings\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"CheckRemoteDebuggerPresent\" (Indicator: \"CheckRemoteDebuggerPresent\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"hoiquantv5.vip.exe\")\n Found string \"GZipStream\" (Source: \"00000000-00005460.00000000.183420.00782000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"hoiquantv5.vip.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00001604.00000000.186282.00EF9000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Load\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"hoiquantv5.vip.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"hoiquantv5.vip.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$39","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"CheckRemoteDebuggerPresent\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001604.00000000.186282.02DA0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005460.00000000.183420.02B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"hoiquantv5.vip.exe\"\n Observed function \"ToBase64String\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; Source: \"00000000-00001604.00000000.186282.00EF9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00005460-00000C2C-1630582662\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"VerifyHash\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"hoiquantv5.vip.exe\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"hoiquantv5.vip.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001604.00000000.186282.02DA0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005460.00000000.183420.02B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001604.00000000.186282.01080000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005460.00000000.183420.00D50000.00000004.mdmp, 00000000-00005460.00000001.185341.00D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00001604.00000000.186282.02DA0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00001604.00000000.186282.02DA0000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00005460.00000000.183420.02B40000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00005460.00000000.183420.02B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$3b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"httpsy//www.youtube.com\" (Indicator: \"youtube.com\"; File: \"screen_6.png\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"hoiquantv5.vip.exe\")\n Found string \"get_MachineName\" (Source: \"00000000-00005460.00000000.183420.00782000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00005460.00000000.183420.00782000.00000002.mdmp\")\n Found string \"get_Is64BitOperatingSystem\" (Source: \"00000000-00005460.00000000.183420.00782000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00005460.00000000.183420.00782000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005460-00000C2C-1631865060\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005460-00000C2C-1631865110\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00001604.00000000.186282.02DA0000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00001604.00000000.186282.02DA0000.00000004.mdmp\")\n Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00005460.00000000.183420.02B40000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00005460.00000000.183420.02B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"hoiquantv5.vip.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005460)\n \"hoiquantv5.vip.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001604)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"hoiquantv5.vip.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005460)\n \"hoiquantv5.vip.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"hoiquantv5.vip.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"hoiquantv5.vip.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"$3c","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"hoiquantv5.vip.exe\" called \"EnumWindows\" with parameter \"100923144\" - (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"hoiquantv5.vip.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005460)\n \"hoiquantv5.vip.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00005460)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008532)\n \"hoiquantv5.vip.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001604)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; File: \"hoiquantv5.vip.exe\")\n Found string \"Select * from AntivirusProduct\" (Indicator: \"select * from \"; File: \"hoiquantv5.vip.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"ExpandEnvironmentVariables\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_SystemDirectory\" in \"hoiquantv5.vip.exe\"\n Observed function \"get_UserName\" in \"hoiquantv5.vip.exe\"\n Observed function \"get_MachineName\" in \"hoiquantv5.vip.exe\"\n Observed function \"get_OSVersion\" in \"hoiquantv5.vip.exe\"\n Observed function \"get_Is64BitOperatingSystem\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"hoiquantv5.vip.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"hoiquantv5.vip.exe\" writes to a file \"%APPDATA%\\hoiquantv5.vip.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"hoiquantv5.vip.exe\" issued a query \"Select * from Win32_ComputerSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"hoiquantv5.vip.exe\" queried token user identity (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"hoiquantv5.vip.exe\" queries volume information of \"C:\\hoiquantv5.vip.exe\" at 00000000-00005460-00000C17-1593242038\n \"cmd.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00008532-00000C17-1637765480\n \"hoiquantv5.vip.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\hoiquantv5.vip.exe\" at 00000000-00001604-00000C17-1637812470","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"hoiquantv5.vip.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"hoiquantv5.vip.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"hoiquantv5.vip.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"hoiquantv5.vip.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"file/memory contains long string(File: \"hoiquantv5.vip.exe\")\n Found string \"set_UseShellExecute\" (Source: \"00000000-00005460.00000000.183420.00782000.00000002.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00005460.00000000.183420.00782000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"timeout 3\" - (UID: 00000000-00008532)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\hoiquantv5.vip.exe\"\" - (UID: 00000000-00008532)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$40","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"services.bingapis.com\"\n \"outlierkit.com\"\n \"koishiai.com\"\n \"miraflow.ai\"\n \"support.google.com\"\n \"techlayers.in\"\n \"www.bozokmedia.com\"\n \"gadgets.beebom.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.18.21.246:6606\"\n \"104.18.21.246:443\"\n \"104.18.21.246:8808\"\n \"99.84.160.78:443\"\n \"150.171.73.13:443\"\n \"18.238.49.62:443\"\n \"104.21.70.97:443\"\n \"172.67.209.100:443\"\n \"172.67.209.100\"\n \"142.251.45.174:443\"\n \"104.21.38.187:443\"\n \"104.21.45.231:443\"\n \"3.168.102.60:443\"\n \"104.21.70.97\"\n \"104.21.38.187\"\n \"104.21.45.231\"\n \"142.250.65.65:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: 6000029-Anti_Analysis~DetectManufacturer, Indicator: \"select * from win32_computersystem\")\n \"Select * from AntivirusProduct\" (Source: 6000032-Methods~Antivirus, Indicator: \"select * from antivirusproduct\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp437B.tmp.bat\"\"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp437B.tmp.bat\"\"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$42","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"hoiquantv5.vip.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"hoiquantv5.vip.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"hoiquantv5.vip.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"tmp437B.tmp.bat\" as clean (type is \"DOS batch file ASCII text with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\tmp437B.tmp.bat\"\"\" (UID: 00000000-00008532)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"hoiquantv5.vip.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:c0000135]\n \"hoiquantv5.vip.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" - [base:0; Status:c0000135]\n \"hoiquantv5.vip.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.dll\" - [base:0; Status:c0000135]\n \"hoiquantv5.vip.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" - [base:0; Status:c0000135]\n \"hoiquantv5.vip.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"hoiquantv5.vip.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetForegroundWindow\" in \"hoiquantv5.vip.exe\"\n Observed unmanaged function \"GetWindowText\" in \"hoiquantv5.vip.exe\"\n Observed unmanaged function \"GetModuleHandle\" in \"hoiquantv5.vip.exe\"\n Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"hoiquantv5.vip.exe\"\n Observed unmanaged function \"SetThreadExecutionState\" in \"hoiquantv5.vip.exe\"\n Observed unmanaged function \"RtlSetProcessIsCritical\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"httpsy//www.youtube.com\" (Indicator: \"youtube\"; File: \"screen_6.png\")\n Found string \"YouTube\" (Indicator: \"youtube\"; File: \"screen_6.png\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00002300)\n Launches browser \"msedge.exe\" (UID: 00000000-00001140)\n Launches browser \"msedge.exe\" (UID: 00000000-00003352)\n Launches browser \"msedge.exe\" (UID: 00000000-00005104)\n Launches browser \"msedge.exe\" (UID: 00000000-00008328)\n Launches browser \"msedge.exe\" (UID: 00000000-00004012)\n Launches browser \"msedge.exe\" (UID: 00000000-00005440)\n Launches browser \"msedge.exe\" (UID: 00000000-00007512)\n Launches browser \"msedge.exe\" (UID: 00000000-00007316)\n Launches browser \"msedge.exe\" (UID: 00000000-00008120)\n Launches browser \"msedge.exe\" (UID: 00000000-00008500)\n Launches browser \"msedge.exe\" (UID: 00000000-00004404)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"hoiquantv5.vip.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\ef4992f14ba62dc115c01e7a6018e263\\mscorlib.ni.dll\" at 73290000\n \"hoiquantv5.vip.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\ef4992f14ba62dc115c01e7a6018e263\\mscorlib.ni.dll\" at 73050000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"hoiquantv5.vip.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 71510000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"hoiquantv5.vip.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75E00000\n \"hoiquantv5.vip.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75C50000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75E00000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75C50000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75E00000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"hoiquantv5.vip.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 747C0000\n \"hoiquantv5.vip.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 74580000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"hoiquantv5.vip.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D40000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D40000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D40000\n \"timeout.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"hoiquantv5.vip.exe\" was detected as \".NET\" and name: \"Library\"\n \"hoiquantv5.vip.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"hoiquantv5.vip.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$46","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"hoiquantv5.vip.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"hoiquantv5.vip.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$47","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\timeout.exe\" [Source: 00000000-00008532-00000C47-3581423572]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp437B.tmp.bat\"\"\" [Source: cmd.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$48","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"clients2.googleusercontent.com\"\n \"edge-consumer-static.azureedge.net\"\n \"gadgets.beebom.com\"\n \"hoiquantv5.vip\"\n \"koishiai.com\"\n \"miraflow.ai\"\n \"outlierkit.com\"\n \"r.msftstatic.com\"\n \"sb.scorecardresearch.com\"\n \"services.bingapis.com\"\n \"support.google.com\"\n \"techlayers.in\"\n \"www.bozokmedia.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"hoiquantv5.vip.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"hoiquantv5.vip.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"hoiquantv5.vip.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"hoiquantv5.vip.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"hoiquantv5.vip.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"hoiquantv5.vip.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$4c","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"$4d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"hoiquantv5.vip.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"hoiquantv5.vip.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"hoiquantv5.vip.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\hoiquantv5.vip.exe]- [targetUID: 00000000-00005460]\n \"tmp437B.tmp.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"- Location: [%TEMP%\\tmp437B.tmp.bat]- [targetUID: 00000000-00008532]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"hoiquantv5.vip.exe\" queries basic process information of the \"C:\\hoiquantv5.vip.exe\" (UID: 5460)\n \"hoiquantv5.vip.exe\" queries basic process information of the \"C:\\Windows\\System32\\svchost.exe\" (UID: 5460)\n \"hoiquantv5.vip.exe\" queries basic process information of the \"C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE\" (UID: 5460)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"hoiquantv5.vip.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"hoiquantv5.vip.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\ef4992f14ba62dc115c01e7a6018e263\\mscorlib.ni.dll.aux\"\n \"hoiquantv5.vip.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\67186481d97828a572bf5db055f4a9f1\\system.ni.dll.aux\"\n \"cmd.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tmp437b.tmp.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"hoiquantv5.vip.exe\" writes file \"%appdata%\\hoiquantv5.vip.exe\"\n \"cmd.exe\" writes file \"%temp%\\tmp437b.tmp.bat\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /favicon?url=cagesideseats.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=ringsidenews.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=thedailyoverview.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=news.lavx.hu?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=notebookcheck.net?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=covenantwealthadvisors.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /?w=32&h=32&q=100&m=6&f=webp&u=t\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$53","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"hoiquantv5.vip.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"set_Credentials\" in \"hoiquantv5.vip.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveBufferSize\" in \"hoiquantv5.vip.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Connect\" in \"hoiquantv5.vip.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"hoiquantv5.vip.exe\"\n Observed namespace \"System.Net\" in \"hoiquantv5.vip.exe\"\n Observed namespace \"System.Net.Security\" in \"hoiquantv5.vip.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$54","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"services.bingapis.com\" has high entropy\n Contacted domain: \"techlayers.in\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy\n Contacted domain: \"hoiquantv5.vip\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1e93d985c806ca627b3b564ad06cc0c3\n Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"techlayers.in\" (8 days old)\n Newly renewed or created SSL certificate: \"www.bozokmedia.com\" (9 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$55","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)\n Short term registered certificate: \"koishiai.com\" (90 days old)\n Short term registered certificate: \"outlierkit.com\" (90 days old)\n Short term registered certificate: \"support.google.com\" (83 days old)\n Short term registered certificate: \"techlayers.in\" (89 days old)\n Short term registered certificate: \"www.bozokmedia.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.18.21.246\" on port \"443\"\n HTTPS traffic to \"99.84.160.78\" on port \"443\"\n HTTPS traffic to \"150.171.73.13\" on port \"443\"\n HTTPS traffic to \"18.238.49.62\" on port \"443\"\n HTTPS traffic to \"104.21.70.97\" on port \"443\"\n HTTPS traffic to \"172.67.209.100\" on port \"443\"\n HTTPS traffic to \"142.251.45.174\" on port \"443\"\n HTTPS traffic to \"104.21.38.187\" on port \"443\"\n HTTPS traffic to \"104.21.45.231\" on port \"443\"\n HTTPS traffic to \"3.168.102.60\" on port \"443\"\n HTTPS traffic to \"142.250.65.65\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001604.00000000.186282.02DA0000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005460.00000000.183420.02B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"hoiquantv5.vip.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\* (UID: 00000000-00005460)\n \"hoiquantv5.vip.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00005460)\n \"hoiquantv5.vip.exe\" called \"FindNextFileW\" with parameter 67186481d97828a572bf5db055f4a9f1 (UID: 00000000-00005460)\n \"hoiquantv5.vip.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\* (UID: 00000000-00005460)\n \"hoiquantv5.vip.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\* (UID: 00000000-00001604)\n \"hoiquantv5.vip.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00001604)\n \"hoiquantv5.vip.exe\" called \"FindNextFileW\" with parameter 67186481d97828a572bf5db055f4a9f1 (UID: 00000000-00001604)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"hoiquantv5.vip.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"hoiquantv5.vip.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"hoiquantv5.vip.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"hoiquantv5.vip.exe\" called \"GetUserNameW\" (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 0a5bcce32b404a33b7f52fa2b3c31336-6000030-Methods~IsAdmin","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00001604.00000000.186282.02DA0000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00001604.00000000.186282.02DA0000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00001604.00000000.186282.02DA0000.00000004.mdmp\")\n Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00005460.00000000.183420.02B40000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00005460.00000000.183420.02B40000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00005460.00000000.183420.02B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; File: \"hoiquantv5.vip.exe\")\n Found string \"Select * from AntivirusProduct\" (Indicator: \"antivirusproduct\"; File: \"hoiquantv5.vip.exe\")\n Found string \"elect * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00005460.00000000.183420.00782000.00000002.mdmp\")\n Found string \"elect * from AntivirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00005460.00000000.183420.00782000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$56","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"hoiquantv5.vip.exe\" opened \"\\Device\\KsecDD\"\n \"cmd.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"hoiquantv5.vip.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"HOSTNAME\"; Value: \"\")\n \"hoiquantv5.vip.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"DOMAIN\"; Value: \"\")\n \"hoiquantv5.vip.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\USERS\\HAPUBWS\\APPDATA\\ROAMING\\HOIQUANTV5.VIP.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"hoiquantv5.vip.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"hoiquantv5.vip.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"0100000000\")\n \"hoiquantv5.vip.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0100000000\")\n \"hoiquantv5.vip.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"hoiquantv5.vip.exe\" - Location: [%APPDATA%\\hoiquantv5.vip.exe]- [targetUID: 00000000-00005460]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"WriteSingle\" (Source: hoiquantv5.vip.exe, API is part of module: WMINET_UTILS.DLL)\n Found string \"SetThreadExecutionState\" (Source: hoiquantv5.vip.exe, API is part of module: KERNEL32.DLL)\n Found string \"Delete\" (Source: hoiquantv5.vip.exe, API is part of module: WMINET_UTILS.DLL)\n Found string \"RtlSetProcessIsCritical\" (Source: hoiquantv5.vip.exe, API is part of module: NTDLL.DLL)\n Found string \"IsAdmin\" (Source: hoiquantv5.vip.exe, API is part of module: WBEMCOMN.DLL)\n Found string \"GetCurrentProcess\" (Source: hoiquantv5.vip.exe, API is part of module: KERNELBASE.DLL)\n Found string \"CheckRemoteDebuggerPresent\" (Source: hoiquantv5.vip.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetForegroundWindow\" (Source: hoiquantv5.vip.exe, API is part of module: USER32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"hoiquantv5.vip.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"hoiquantv5.vip.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"hoiquantv5.vip.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5460)\n \"hoiquantv5.vip.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1604)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"SbieDll.dll\" (Indicator: \"sbiedll.dll\"; File: \"hoiquantv5.vip.exe\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO TLS Handshake Failure\" (SID: 2029340, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/24 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 18.238.49.62\"\n \"UDP connection to 104.21.70.97\"\n \"UDP connection to 172.67.209.100\"\n \"UDP connection to 142.251.45.174\"\n \"UDP connection to 104.21.38.187\"\n \"UDP connection to 104.21.45.231\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"hoiquantv5.vip.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\hoiquantv5.vip.exe]- [targetUID: 00000000-00005460]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Network Related","name":"Application communicates to suspicious domain","description":"Contacted Domain: \"techlayers.in\" has been identified as suspicious\n Contacted Domain: \"bozokmedia.com\" has been identified as suspicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-89","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$57","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Network Related","name":"Detected network traffic to commonly abused domain","description":"Domain: \"hoiquantv5.vip\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes.","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":5,"id":"network-84","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Network Related","name":"Recently registered domain detected","description":"Recently Registered domain detected: \"techlayers.in\" (23 days old). Commonly seen with phishing or other suspicious domains","origin":"Network Traffic","mitre_attack_id":"T1583.001","relevance":10,"id":"network-8600","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.18.21.246 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"$58","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 104.18.21.246 on port 6606\n TCP traffic to 104.18.21.246 on port 8808","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse\" matched process \"00000000-00005460\" as \"Detects file containing reversed ASEP Autorun registry keys\"\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse\" matched file \"sample.bin\" as \"Detects file containing reversed ASEP Autorun registry keys\"\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse\" matched file \"hoiquantv5.vip.exe.2206461261\" as \"Detects file containing reversed ASEP Autorun registry keys\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"hoiquantv5.vip.exe\" issued a query \"Select * from Win32_ComputerSystem\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\tmp437B.tmp.bat\"\"\" (UID: 00000000-00008532)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"cmd.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmp437B.tmp.bat\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"hoiquantv5.vip.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"hoiquantv5.vip.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/24 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"17/24 Antivirus vendors marked dropped file \"hoiquantv5.vip.exe\" as malicious (classified as \"Generic.AsyncRAT.Marte.B\" with 70% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"17/24 Antivirus vendors marked spawned process \"hoiquantv5.vip.exe\" (PID: 1604) as malicious (classified as \"Generic.AsyncRAT.Marte.B\" with 70% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 74F00000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /f /sc onlogon /rl highest /tn \"hoiquantv5.vip\" /tr '\"%APPDATA%\\\\hoiquantv5.vip.exe\"'\" (UID: 00000000-00001248)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 516)\n \"cmd.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 516)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 516)\n \"cmd.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\hoiquantv5.vip.exe\" (Handle: 516)\n \"cmd.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\hoiquantv5.vip.exe\" (Handle: 516)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\hoiquantv5.vip.exe\" (Handle: 516)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"hoiquantv5.vip\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"clients2.googleusercontent.com\" with TTL 300\n \"edge-consumer-static.azureedge.net\" with TTL 83\n \"gadgets.beebom.com\" with TTL 60\n \"hoiquantv5.vip\" with TTL 300\n \"koishiai.com\" with TTL 300\n \"outlierkit.com\" with TTL 300\n \"r.msftstatic.com\" with TTL 113\n \"sb.scorecardresearch.com\" with TTL 60\n \"support.google.com\" with TTL 300\n \"techlayers.in\" with TTL 300\n \"www.bozokmedia.com\" with TTL 300","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"hoiquantv5.vip.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$59","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 13 domains and 13 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]}],"intel_graph":{"map":{"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:gadgets.beebom.com":{"type":"Domain","value":"gadgets.beebom.com"},"Domain:hoiquantv5.vip":{"type":"Domain","value":"hoiquantv5.vip"},"Domain:koishiai.com":{"type":"Domain","value":"koishiai.com"},"Domain:miraflow.ai":{"type":"Domain","value":"miraflow.ai"},"Domain:outlierkit.com":{"type":"Domain","value":"outlierkit.com"},"Domain:r.msftstatic.com":{"type":"Domain","value":"r.msftstatic.com"},"Domain:sb.scorecardresearch.com":{"type":"Domain","value":"sb.scorecardresearch.com"},"Domain:services.bingapis.com":{"type":"Domain","value":"services.bingapis.com"},"Domain:support.google.com":{"type":"Domain","value":"support.google.com"},"Domain:techlayers.in":{"type":"Domain","value":"techlayers.in"},"Domain:www.bozokmedia.com":{"type":"Domain","value":"www.bozokmedia.com"},"File:a6d4cb8d65c8221e674200bd2bdd955a7356da93b4cc71e140e8873937b89ffc":{"type":"File","value":"a6d4cb8d65c8221e674200bd2bdd955a7356da93b4cc71e140e8873937b89ffc"},"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22":{"type":"File","value":"b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections","filetype_short":"PE32"},"Ip:104.18.21.246":{"type":"Ip","value":"104.18.21.246"},"Ip:104.21.38.187":{"type":"Ip","value":"104.21.38.187"},"Ip:104.21.45.231":{"type":"Ip","value":"104.21.45.231"},"Ip:104.21.70.97":{"type":"Ip","value":"104.21.70.97"},"Ip:142.250.65.65":{"type":"Ip","value":"142.250.65.65"},"Ip:142.251.45.174":{"type":"Ip","value":"142.251.45.174"},"Ip:150.171.110.7":{"type":"Ip","value":"150.171.110.7"},"Ip:150.171.27.10":{"type":"Ip","value":"150.171.27.10"},"Ip:150.171.73.13":{"type":"Ip","value":"150.171.73.13"},"Ip:172.67.209.100":{"type":"Ip","value":"172.67.209.100"},"Ip:18.238.49.62":{"type":"Ip","value":"18.238.49.62"},"Ip:3.168.102.60":{"type":"Ip","value":"3.168.102.60"},"Ip:99.84.160.78":{"type":"Ip","value":"99.84.160.78"},"Url:/?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=cagesideseats.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=cagesideseats.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=covenantwealthadvisors.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=covenantwealthadvisors.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=news.lavx.hu?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=news.lavx.hu?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=notebookcheck.net?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=notebookcheck.net?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=ringsidenews.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=ringsidenews.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=thedailyoverview.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=thedailyoverview.com?w=32&h=32&q=100&m=6&f=webp&u=t"}},"chains":[{"id":"1570179925956138529","root":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]}},{"id":"sandbox_network","root":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","edges":[{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:104.18.21.246"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:104.18.21.246"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:104.18.21.246"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:99.84.160.78"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:150.171.73.13"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:18.238.49.62"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:104.21.70.97"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:172.67.209.100"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:172.67.209.100"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:142.251.45.174"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:104.21.38.187"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:104.21.45.231"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:3.168.102.60"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:104.21.70.97"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:104.21.38.187"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:104.21.45.231"},{"edge_kind":"contacted_ip","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Ip:142.250.65.65"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.250.65.65"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.110.7"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:gadgets.beebom.com"},{"edge_kind":"resolves_to","from_key":"Domain:gadgets.beebom.com","to_key":"Ip:3.168.102.60"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:hoiquantv5.vip"},{"edge_kind":"resolves_to","from_key":"Domain:hoiquantv5.vip","to_key":"Ip:104.18.21.246"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:koishiai.com"},{"edge_kind":"resolves_to","from_key":"Domain:koishiai.com","to_key":"Ip:172.67.209.100"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:miraflow.ai"},{"edge_kind":"resolves_to","from_key":"Domain:miraflow.ai","to_key":"Ip:18.238.49.62"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:outlierkit.com"},{"edge_kind":"resolves_to","from_key":"Domain:outlierkit.com","to_key":"Ip:104.21.70.97"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:r.msftstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:r.msftstatic.com","to_key":"Ip:150.171.27.10"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:sb.scorecardresearch.com"},{"edge_kind":"resolves_to","from_key":"Domain:sb.scorecardresearch.com","to_key":"Ip:99.84.160.78"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:services.bingapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:services.bingapis.com","to_key":"Ip:150.171.73.13"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:support.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:support.google.com","to_key":"Ip:142.251.45.174"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:techlayers.in"},{"edge_kind":"resolves_to","from_key":"Domain:techlayers.in","to_key":"Ip:104.21.38.187"},{"edge_kind":"contacted_domain","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Domain:www.bozokmedia.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.bozokmedia.com","to_key":"Ip:104.21.45.231"},{"edge_kind":"contacted_url","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Url:/favicon?url=cagesideseats.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Url:/favicon?url=ringsidenews.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Url:/favicon?url=thedailyoverview.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Url:/favicon?url=news.lavx.hu?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Url:/favicon?url=notebookcheck.net?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Url:/favicon?url=covenantwealthadvisors.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Url:/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"Url:/?w=32&h=32&q=100&m=6&f=webp&u=t"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","edges":[{"edge_kind":"extracted","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22"},{"edge_kind":"extracted","from_key":"File:b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","to_key":"File:a6d4cb8d65c8221e674200bd2bdd955a7356da93b4cc71e140e8873937b89ffc"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":20,"spawned_processes_count":20,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":22,"imported_dlls_count":73,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":17,"dns_resolutions_count":13,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":["commodity","agent","modular","rat","opensource","criminal","asyncrat","malicious","new_domain","suspicious","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6af4d5ffead21dc4c808093a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.AsyncRAT.Marte.B","contacted_countries":["USA"],"submit_name":"hoiquantv5.vip.exe","analysis_start_time":"2026-11-11T20:54:25+00:00","indicators_count":{"informative":159,"suspicious":42,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.18.21.246","port":6606,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"104.18.21.246","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"104.18.21.246","port":8808,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"99.84.160.78","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"150.171.73.13","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"18.238.49.62","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"104.21.70.97","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"172.67.209.100","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"172.67.209.100","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"142.251.45.174","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"104.21.38.187","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"104.21.45.231","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"3.168.102.60","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"104.21.70.97","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"104.21.38.187","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"104.21.45.231","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"address":"142.250.65.65","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]}],"dns_resolutions":[{"domain":"clients2.googleusercontent.com","address":"142.250.65.65","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.110.7","ttl":83,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"gadgets.beebom.com","address":"3.168.102.60","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"hoiquantv5.vip","address":"104.18.21.246","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"koishiai.com","address":"172.67.209.100","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"miraflow.ai","address":"18.238.49.62","ttl":718,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"outlierkit.com","address":"104.21.70.97","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"r.msftstatic.com","address":"150.171.27.10","ttl":113,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"sb.scorecardresearch.com","address":"99.84.160.78","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"services.bingapis.com","address":"150.171.73.13","ttl":1277,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"support.google.com","address":"142.251.45.174","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"techlayers.in","address":"104.21.38.187","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"domain":"www.bozokmedia.com","address":"104.21.45.231","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]}],"http_requests":[{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=cagesideseats.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=cagesideseats.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=ringsidenews.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=ringsidenews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=thedailyoverview.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=thedailyoverview.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=news.lavx.hu?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=news.lavx.hu?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=notebookcheck.net?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=notebookcheck.net?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=covenantwealthadvisors.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=covenantwealthadvisors.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"host":"outlierkit.com","host_ip":"104.21.70.97:443","url":"/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: outlierkit.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"host":"support.google.com","host_ip":"142.251.45.174:443","url":"/?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: support.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}],"processes":[{"pid":5460,"ppid":0,"name":"hoiquantv5.vip.exe","command_line":"","sha256":"b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","normalized_path":"C:\\hoiquantv5.vip.exe","uid":"00000000-00005460","icon":"$5a"},{"pid":3908,"ppid":5460,"name":"cmd.exe","command_line":"/c schtasks /create /f /sc onlogon /rl highest /tn \"hoiquantv5.vip\" /tr '\"%APPDATA%\\hoiquantv5.vip.exe\"' & exit","sha256":"36fffab256a48c6fb76a4d1199193195e7707e9019414ac87572c3dbc810bc6c","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00005460","uid":"00000000-00003908"},{"pid":1248,"ppid":3908,"name":"schtasks.exe","command_line":"schtasks /create /f /sc onlogon /rl highest /tn \"hoiquantv5.vip\" /tr '\"%APPDATA%\\hoiquantv5.vip.exe\"'","sha256":"76f38ac5bb091807feecc48eb391b142f6f54f72ba0a5a38ae8be2ac374fc177","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00003908","uid":"00000000-00001248"},{"pid":8532,"ppid":5460,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp437B.tmp.bat\"\"","sha256":"36fffab256a48c6fb76a4d1199193195e7707e9019414ac87572c3dbc810bc6c","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00005460","uid":"00000000-00008532"},{"pid":7588,"ppid":8532,"name":"timeout.exe","command_line":"timeout 3","sha256":"dab1647e4a1f207835162d87192a173519b1bc1fc274f2e17421702fffa578e7","normalized_path":"%WINDIR%\\SysWOW64\\timeout.exe","parent_uid":"00000000-00008532","uid":"00000000-00007588"},{"pid":1604,"ppid":8532,"name":"hoiquantv5.vip.exe","command_line":"","sha256":"b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","normalized_path":"%APPDATA%\\hoiquantv5.vip.exe","parent_uid":"00000000-00008532","uid":"00000000-00001604"},{"pid":2300,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00002300","icon":"$5b"},{"pid":1140,"ppid":2300,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffbab8b0f18,0x7ffbab8b0f24,0x7ffbab8b0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002300","uid":"00000000-00001140"},{"pid":3352,"ppid":2300,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1776,i,15761274772173537663,14228516122759774726,262144 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2036 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002300","uid":"00000000-00003352"},{"pid":5104,"ppid":2300,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1972,i,7467303408549847798,880911441256390374,524288 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2240 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002300","uid":"00000000-00005104"},{"pid":8328,"ppid":2300,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2380,i,6428452479578880521,10279073234195891378,524288 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3176 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002300","uid":"00000000-00008328"},{"pid":4012,"ppid":2300,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1794427659717010 --launch-time-ticks=3009777077 --skip-read-main-dll --metrics-shmem-handle=3308,i,5299162437468842783,4922524624701083208,2097152 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3376 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002300","uid":"00000000-00004012"},{"pid":5440,"ppid":2300,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1794427659717010 --launch-time-ticks=3009752754 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2788,i,16758478198431106436,16488284905727044418,2097152 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3336 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002300","uid":"00000000-00005440"},{"pid":7512,"ppid":2300,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5968,i,4236128394190744373,5800415047437063054,524288 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=6012 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002300","uid":"00000000-00007512"},{"pid":7316,"ppid":2300,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5988,i,18068041122586265807,14783166919561097005,524288 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=6032 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002300","uid":"00000000-00007316"},{"pid":4540,"ppid":2300,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6688,i,16254218155976895502,13441484918623894912,524288 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6704 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00002300","uid":"00000000-00004540"},{"pid":8584,"ppid":2300,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6688,i,16254218155976895502,13441484918623894912,524288 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6704 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00002300","uid":"00000000-00008584"},{"pid":8120,"ppid":2300,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=3900,i,10957734042431339092,17837431700789996106,524288 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=6916 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002300","uid":"00000000-00008120"},{"pid":8500,"ppid":2300,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3348,i,7243057175241027253,10686226288253101403,524288 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6908 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002300","uid":"00000000-00008500"},{"pid":4404,"ppid":2300,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=3352,i,18162572080934455368,16390746518907381307,524288 --field-trial-handle=2052,i,4423543395318454682,12276454261850917670,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6960 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002300","uid":"00000000-00004404"}],"all_imported_dlls":["amsi.dll","wow64win.dll","mscoree.dll","ucrtbase_clr0400.dll","taskschd.dll","ntdll.dll","KernelBase.dll","rpcrt4.dll","imm32.dll","SHCore.dll","rsaenh.dll","urlmon.dll","netutils.dll","wow64.dll","wow64cpu.dll","msvcrt.dll","clr.dll","gdi32.dll","iertutil.dll","virtdisk.dll","BCP47Langs.dll","fltLib.dll","System.ni.dll","srvcli.dll","WinTypes.dll","bcrypt.dll","ole32.dll","ws2_32.dll","windows.storage.dll","OneCoreCommonProxyStub.dll","cmdext.dll","apphelp.dll","kernel32.dll","mscorlib.ni.dll","System.Management.dll","wbemsvc.dll","msvcp_win.dll","crypt32.dll","xmllite.dll","version.dll","combase.dll","bcryptprimitives.dll","oleaut32.dll","sspicli.dll","WMINet_Utils.dll","psapi.dll","edputil.dll","g9vU9151.dll","sechost.dll","mscoreei.dll","clrjit.dll","VxSSL32.dll","profapi.dll","win32u.dll","shlwapi.dll","vcruntime140.dll","cryptsp.dll","cryptbase.dll","uxtheme.dll","advapi32.dll","user32.dll","gdi32full.dll","msvcp140.dll","wldp.dll","Windows.StateRepositoryPS.dll","kernel.appcore.dll","ucrtbase.dll","shell32.dll","fastprox.dll","propsys.dll","clbcatq.dll","vcruntime140_clr0400.dll","cfgmgr32.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"hoiquantv5.vip.exe","sha256":"b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"tmp437B.tmp.bat","sha256":"a6d4cb8d65c8221e674200bd2bdd955a7356da93b4cc71e140e8873937b89ffc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5460:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5460:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"Local\\SM0:5460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"SM0:5460:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"SM0:5460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3908:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"SM0:3908:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1248:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"SM0:1248:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8532:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"SM0:8532:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1604:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1604:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1604:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"Local\\SM0:1604:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"SM0:1604:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]},{"name":"SM0:1604:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af4d5ffead21dc4c808093a"}]}]}},"report_ids":{"sandbox_job_ids":["6af4d5ffead21dc4c808093a"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious RAT Sample b7cd215e4c0b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b7cd215e4c0b…. Malware family: RAT. Threat score 100/100. 18/25 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22"}],["$","meta","4",{"property":"og:title","content":"Malicious RAT Sample b7cd215e4c0b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b7cd215e4c0b…. Malware family: RAT. Threat score 100/100. 18/25 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b7cd215e4c0bc07ccda4ba734955cc1487c484f82e96aff1473fe19815c43d22"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious RAT Sample b7cd215e4c0b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b7cd215e4c0b…. Malware family: RAT. Threat score 100/100. 18/25 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5c","11",{}]] 32:null