Edit tour

Windows Analysis Report
SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Overview

General Information

Sample name:	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe
Analysis ID:	1543319
MD5:	df3ca79177e6ae81bf45f894b6683c14
SHA1:	520475c8efda7d4c14165436156417a1bbfd92aa
SHA256:	4f48297c67bb0803164f3e3f10135ad23ca6db7650c74f81227df8cf47efc659

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found direct / indirect Syscall (likely to bypass EDR)

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Process Tree

System is w10x64native

SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe (PID: 9072 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe" MD5: DF3CA79177E6AE81BF45F894B6683C14)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

ReversingLabs: Detection: 18%

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1291523167.00000182A4339000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4A69000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4A92000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1257142867.00000182A4365000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1257027393.00000182A4361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1257652683.00000182A46A0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1292702703.00000182A47D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1291523167.00000182A4339000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4A69000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4A92000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1257142867.00000182A4365000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1257027393.00000182A4361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1257652683.00000182A46A0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1292702703.00000182A47D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.co
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4AC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUgUABBQpQV
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1291523167.00000182A4339000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4A92000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1257142867.00000182A4365000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1257027393.00000182A4361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crle
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A46D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.intel.com/support/gfx_feedback
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=98A3FD9E78FC44C7A06C3A0E80307840&timeOut=5000&oc
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Alert/Alert_FD_B.png
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Alert/Alert_FD_B.svg
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAehR3S.png
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAehR3S.svg
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.png
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/temprise1.svg
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240908.1/Weather/W01_Sunn
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240908.1/WeatherInsight/W
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12PNdd
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12PNdd-dark
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or-dark
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4A87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://edition.cnn.com/2019/01/15/politics/donald-trump-fast-food-clemson-tigers/index.html
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.comE
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/downloadthumbnail/
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/downloadthumbnail/:K
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgames2/
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgames2/B
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgames2/y
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgamesettings2/
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgamesettings2/0K
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgamesettings2/E
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgamesettings2/dJLm
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgamesettings2/i1
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.redirectingat.com?id=74968X1553576&url=https%3A%2F%2Fwww.petco.com%2Fcontent%2Fpetco%2FPe
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA12I8qo.img
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA12lNhl.img
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15YhMq.img
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAywGC0.img
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1e6XdQ.img
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/edge/ntp?cm=en-us&ocid=widgetonlockscreenwin10&cvid=32798c55-53d0-4330-98c1-75a3
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1292702703.00000182A4814000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1257652683.00000182A46D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrd?l
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.comf?
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comer
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stacker.com
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stacker.com/art-culture/20-life-changing-locations-inspired-movies-books-and-art
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stacker.com/food-drink/15-formerly-popular-foods-america-are-rarely-eaten-today
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stacker.com/stories
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://today.yougov.com/ratings/consumer/popularity/dining-brands/all
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/P
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/nJBm
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgames2/
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgames2/y
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/O
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/byy
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-us&chosenMarketReason=implicitNew
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-us&chosenMarketReason=implicitNew
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.merriam-webster.com/wordplay/new-words-in-the-dictionary
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/feed
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/foodanddrink/other/why-so-many-southerners-go-by-their-middle-names/ar-AA1
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/foodanddrink/recipes/14-of-john-wayne-s-favorite-foods/ar-BB1m7Zyk
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/health/other/daylight-saving-time-ends-next-weekend-this-is-how-to-prepare
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/companies/how-s-that-my-fault-home-warranty-company-refused-to-pay-u
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/movies/news/top-10-movies-where-the-cast-had-most-fun-during-production/vi
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/harris-calls-on-the-united-states-to-turn-the-page-on-hatred
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/jake-tapper-and-jd-vance-have-fiery-exchange-over-trump-s-en
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/jd-vance-negotiating-with-russia-is-a-necessary-part-of-endi
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/50-slang-terms-only-people-over-25-years-old-will-understa
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/search-underway-for-man-accused-of-killing-his-pregnant-wife-while
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/washington-post-reports-elon-musk-briefly-worked-illegally-in-us-i
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/what-all-those-sexy-halloween-costumes-are-doing-to-kids/ar-AA1t0Y
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/satellite-images-show-damage-from-israeli-attack-at-2-iranian-m
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/mlb/yamamoto-shuts-down-yankees-freeman-homers-again-as-dodgers-win
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/college-football-rankings-week-10-top-10-teams/ar-AA1t0rWh
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/travel/news/american-airlines-tests-boarding-technology-that-audibly-shame
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/forecast/in-New-York?loc=eyJsIjoiTmV3IFlvcmsiLCJyIjoiTmV3IFlvcmsiL
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/hourlyforecast/in-New-York?loc=eyJsIjoiTmV3IFlvcmsiLCJyIjoiTmV3IFl
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/maps/wildfire/in-New-York?loc=eyJsIjoiTmV3IFlvcmsiLCJyIjoiTmV3IFlv
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.nytimes.com/2021/04/20/magazine/filet-o-fish-asian-americans.html

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4BBF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBp

Source: classification engine

Classification label: mal64.evad.winEXE@1/0@0/0

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM Win32_Process

Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: perfos.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	Section loaded: profapi.dll	Jump to behavior

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Static file information: File size 31139840 > 1048576

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1d56400

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PortConnector
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM CIM_PhysicalConnector
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM CIM_Slot

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1235468750.00000182A28DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O T
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A47AE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processor
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor]$ *!
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A47AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipesl[
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A47AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partitionl
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor,w
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1245246424.00000182A4265000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1244231281.00000182A4265000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partition
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partition
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor4\
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A47AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Servicem
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus Pipes
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4A87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Serviceu%X+
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A47AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1234802463.00000182A42AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1234599930.00000182A4222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1231986806.00000182A4222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1232352690.00000182A4222000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Se
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1235468750.00000182A28DA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1233143599.00000182A28DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accu
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1235244787.00000182A4225000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1234395256.00000182A4225000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860I
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipes
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipesl
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processorll?X
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processorkw
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A47AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processorc.sys
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisorui
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A47AE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A482F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisorr
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A47AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partition
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1231643380.00000182A41E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1245246424.00000182A421B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1243411053.00000182A420B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1244231281.00000182A421B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshotnt oAA
Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1274755346.00000182A47AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partitionty>

Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Process information queried: ProcessInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	NtQueryInformationProcess: Indirect: 0x7FF6A60F2ED5	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	NtQueryInformationProcess: Indirect: 0x7FF6A60F2E3C	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	NtQueryInformationProcess: Indirect: 0x7FF6A60F1ACC	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	NtQueryInformationProcess: Indirect: 0x7FF6A60F1958	Jump to behavior

Source: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1262762360.00000182A46B0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1262762360.00000182A46EF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	321 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	321 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe	18%	ReversingLabs	Win64.Trojan.Generic

Name	Source	Malicious	Reputation
https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://powerpoint.office.comer	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4F2A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/politics/jd-vance-negotiating-with-russia-is-a-necessary-part-of-endi	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12PNdd	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://outlook.comf?	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4F2A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240908.1/Weather/W01_Sunn	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12PNdd-dark	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgamesettings2/0K	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgamesettings2/dJLm	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/health/other/daylight-saving-time-ends-next-weekend-this-is-how-to-prepare	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://stacker.com/art-culture/20-life-changing-locations-inspired-movies-books-and-art	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/weather/maps/wildfire/in-New-York?loc=eyJsIjoiTmV3IFlvcmsiLCJyIjoiTmV3IFlv	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/feed	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or-dark	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/O	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/weather/hourlyforecast/in-New-York?loc=eyJsIjoiTmV3IFlvcmsiLCJyIjoiTmV3IFl	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/movies/news/top-10-movies-where-the-cast-had-most-fun-during-production/vi	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/politics/harris-calls-on-the-united-states-to-turn-the-page-on-hatred	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.png	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/us/what-all-those-sexy-halloween-costumes-are-doing-to-kids/ar-AA1t0Y	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://deff.nelreports.net/api/report?cat=msn	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4A87000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgamesettings2/	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/politics/jake-tapper-and-jd-vance-have-fiery-exchange-over-trump-s-en	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/technology/50-slang-terms-only-people-over-25-years-old-will-understa	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://stacker.com	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/us/washington-post-reports-elon-musk-briefly-worked-illegally-in-us-i	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgames2/y	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/nJBm	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAehR3S.svg	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/downloadthumbnail/:K	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgamesettings2/i1	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgames2/	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/sports/other/college-football-rankings-week-10-top-10-teams/ar-AA1t0rWh	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/money/companies/how-s-that-my-fault-home-warranty-company-refused-to-pay-u	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/sports/mlb/yamamoto-shuts-down-yankees-freeman-homers-again-as-dodgers-win	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgames2/	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/P	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://edition.cnn.com/2019/01/15/politics/donald-trump-fast-food-clemson-tigers/index.html	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://word.office.com	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4F2A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/byy	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240908.1/WeatherInsight/W	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/foodanddrink/recipes/14-of-john-wayne-s-favorite-foods/ar-BB1m7Zyk	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://windows.msn.com:443/shellv2?osLocale=en-us&chosenMarketReason=implicitNew	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.merriam-webster.com/wordplay/new-words-in-the-dictionary	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgamesettings2/E	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://windows.msn.com:443/shell?osLocale=en-us&chosenMarketReason=implicitNew	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgames2/y	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgames2/B	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://stacker.com/food-drink/15-formerly-popular-foods-america-are-rarely-eaten-today	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Alert/Alert_FD_B.svg	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/travel/news/american-airlines-tests-boarding-technology-that-audibly-shame	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://ocsp.digicert.co	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1257652683.00000182A46A0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1292702703.00000182A47D9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=98A3FD9E78FC44C7A06C3A0E80307840&timeOut=5000&oc	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/us/search-underway-for-man-accused-of-killing-his-pregnant-wife-while	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Alert/Alert_FD_B.png	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ntp.msn.com/edge/ntp?cm=en-us&ocid=widgetonlockscreenwin10&cvid=32798c55-53d0-4330-98c1-75a3	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://excel.office.comE	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4F2A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/world/satellite-images-show-damage-from-israeli-attack-at-2-iranian-m	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/weather/forecast/in-New-York?loc=eyJsIjoiTmV3IFlvcmsiLCJyIjoiTmV3IFlvcmsiL	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://today.yougov.com/ratings/consumer/popularity/dining-brands/all	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAehR3S.png	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/temprise1.svg	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://stacker.com/stories	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/downloadthumbnail/	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.intel.com/support/gfx_feedback	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A46D7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.nytimes.com/2021/04/20/magazine/filet-o-fish-asian-americans.html	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://go.redirectingat.com?id=74968X1553576&url=https%3A%2F%2Fwww.petco.com%2Fcontent%2Fpetco%2FPe	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/foodanddrink/other/why-so-many-southerners-go-by-their-middle-names/ar-AA1	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1269162237.00000182A4D35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4691000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe, 00000000.00000003.1273296153.00000182A4689000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543319
Start date and time:	2024-10-27 17:11:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe
Detection:	MAL
Classification:	mal64.evad.winEXE@1/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.998832150472728
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe
File size:	31'139'840 bytes
MD5:	df3ca79177e6ae81bf45f894b6683c14
SHA1:	520475c8efda7d4c14165436156417a1bbfd92aa
SHA256:	4f48297c67bb0803164f3e3f10135ad23ca6db7650c74f81227df8cf47efc659
SHA512:	2e04d4b0d534f01067a075548b14a1118200cdf71d4fa7cbd1a91b2a80f6a2bc4c5fe7f1c558494ba454b096b3af128288940b635e6aea1e500851ad00c4cc2e
SSDEEP:	786432:xIa0gdHQKaWE3Kp/Fk/k41D7cAItlD271/Lzkpb7hd2QJ:xB6Wr/FEkkfcRtMx/3kp1d2
TLSH:	0C673393F090C57DD524D2B1DBA22222EA2278178FB474E353D81E242D4AFD8967FF94
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....0.f.........."............................@..........................................`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400488b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CA3008 [Sat Aug 24 19:10:00 2024 UTC]
TLS Callbacks:	0x4002e060, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3d6564717819e42a19ff0f516eca2242

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F76492CCC90h
dec eax
add esp, 28h
jmp 00007F76492CC8B7h
int3
int3
dec eax
sub esp, 28h
call 00007F76492CCA54h
dec eax
neg eax
sbb eax, eax
neg eax
dec eax
dec eax
add esp, 28h
ret
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
cmp dword ptr [01D69166h], FFFFFFFFh
dec eax
mov ebx, ecx
jne 00007F76492CCA49h
call 00007F76492CDEC5h
jmp 00007F76492CCA51h
dec eax
mov edx, ebx
dec eax
lea ecx, dword ptr [01D69150h]
call 00007F76492CDE30h
xor edx, edx
test eax, eax
dec eax
cmove edx, ebx
dec eax
mov eax, edx
dec eax
add esp, 20h
pop ebx
ret
int3
int3
dec eax
sub esp, 18h
dec esp
mov eax, ecx
mov eax, 00005A4Dh
cmp word ptr [FFFB76D5h], ax
jne 00007F76492CCABAh
dec eax
arpl word ptr [FFFB7708h], cx
dec eax
lea edx, dword ptr [FFFB76C5h]
dec eax
add ecx, edx
cmp dword ptr [ecx], 00004550h
jne 00007F76492CCAA1h
mov eax, 0000020Bh
cmp word ptr [ecx+18h], ax
jne 00007F76492CCA96h
dec esp
sub eax, edx
movzx edx, word ptr [ecx+14h]
dec eax
add edx, 18h
dec eax
add edx, ecx
movzx eax, word ptr [ecx+06h]
dec eax
lea ecx, dword ptr [eax+eax*4]
dec esp
lea ecx, dword ptr [edx+ecx*8]
dec eax
mov dword ptr [esp], edx
dec ecx
cmp edx, ecx
je 00007F76492CCA5Ah
mov ecx, dword ptr [edx+0Ch]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1dad268	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1db3000	0x1b84	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1db8000	0x70c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1dad140	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1daa9b0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1da5b70	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1dad8e0	0x570	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x58a66	0x58c00	125e3f2bcd3f263a8791c67ed633bd01	False	0.5132262323943662	data	6.458143500240216	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x5a000	0x1d5637c	0x1d56400	6ccf4f906f66470f7dbe84f7453277ea	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1db1000	0x1bd0	0xa00	f89f83e50853d702d81a1d2f1fada699	False	0.146484375	data	1.898901291986417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1db3000	0x1b84	0x1c00	cc2e2b37b4bd18aee5e9dcb60d19f27f	False	0.5110212053571429	data	5.793195597431052	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0x1db5000	0x80	0x200	94baceba662d5eaa84ce6a28e96d73c0	False	0.21484375	data	1.473598035294352	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x1db6000	0xa1	0x200	2b3aead56f8cd1ad5cf40bdff60fc742	False	0.037109375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x1db7000	0x1f4	0x200	9e234c34f0ebe9d234138703bdff563d	False	0.51171875	data	4.195692367914678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1db8000	0x70c	0x800	d4ef5d8f937c9d152d141fccf655af44	False	0.5517578125	data	5.176197097017553	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	AddVectoredExceptionHandler, CheckRemoteDebuggerPresent, CloseHandle, CompareStringOrdinal, CompareStringW, CreateDirectoryW, CreateFileW, CreateNamedPipeW, CreateProcessW, CreateThread, CreateWaitableTimerExW, DeleteCriticalSection, DeleteProcThreadAttributeList, DuplicateHandle, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileExA, FindFirstFileW, FindNextFileA, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetComputerNameExW, GetConsoleCP, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileType, GetFullPathNameW, GetLastError, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetProcessIoCounters, GetProcessTimes, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetSystemTimePreciseAsFileTime, GetSystemTimes, GetTempPathW, GetTickCount64, GetWindowsDirectoryW, GlobalMemoryStatusEx, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeProcThreadAttributeList, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, K32GetPerformanceInfo, LCMapStringW, LeaveCriticalSection, LoadLibraryExA, LoadLibraryExW, LocalFree, MultiByteToWideChar, OpenProcess, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReadFileEx, ReadProcessMemory, RtlCaptureContext, RtlLookupFunctionEntry, RtlUnwindEx, RtlVirtualUnwind, SetEnvironmentVariableA, SetFileInformationByHandle, SetFilePointerEx, SetLastError, SetStdHandle, SetThreadExecutionState, SetThreadStackGuarantee, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SleepEx, SwitchToThread, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, UpdateProcThreadAttribute, VirtualQueryEx, WaitForSingleObject, WideCharToMultiByte, WriteConsoleW, WriteFile, WriteFileEx
bcryptprimitives.dll	ProcessPrng
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressAll, WakeByAddressSingle
ntdll.dll	NtQueryInformationProcess, NtQuerySystemInformation, NtWriteFile, RtlGetVersion, RtlNtStatusToDosError
ADVAPI32.dll	CopySid, GetLengthSid, GetTokenInformation, IsValidSid, OpenProcessToken, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, SystemFunction036
bcrypt.dll	BCryptGenRandom
powrprof.dll	CallNtPowerInformation
ole32.dll	CoCreateInstance, CoInitializeEx, CoInitializeSecurity, CoSetProxyBlanket
shell32.dll	CommandLineToArgvW, ShellExecuteExW
oleaut32.dll	GetErrorInfo, SafeArrayAccessData, SafeArrayDestroy, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayUnaccessData, SysAllocStringLen, SysFreeString, SysStringLen, VariantClear
psapi.dll	GetModuleFileNameExW
pdh.dll	PdhAddEnglishCounterW, PdhCloseQuery, PdhCollectQueryData, PdhGetFormattedCounterValue, PdhOpenQueryA, PdhRemoveCounter

Target ID:	0
Start time:	12:13:22
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe"
Imagebase:	0x7ff6a60b0000
File size:	31'139'840 bytes
MD5 hash:	DF3CA79177E6AE81BF45F894B6683C14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exePID: 9072, Parent PID: 5080

General

Chronological Activities

Disassembly

Windows Analysis Report
SecuriteInfo.com.QD.Trojan.GenericKDQ.624E6F2697.13291.32063.exe