Windows Analysis Report
Quote35664776.exe

Overview

General Information

Sample name: Quote35664776.exe
Analysis ID: 1543824
MD5: 560b914d9a5652a2cd8e91885a866954
SHA1: e516c3e218ab80245f3f2eb1502a1ecb07e69ba3
SHA256: bcca185afcdcd92fde60a3d4676f7efd40126e9ce50d9971f7e725bd04b8bfb4
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Quote35664776.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: Quote35664776.exe ReversingLabs: Detection: 42%
Yara detected FormBook
Source: Yara match File source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: Quote35664776.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Quote35664776.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Quote35664776.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: Quote35664776.exe, 00000007.00000002.1359717433.00000000014A0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: Quote35664776.exe, Quote35664776.exe, 00000007.00000002.1359717433.00000000014A0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: yjvR.pdb source: Quote35664776.exe
Source: Binary string: yjvR.pdbSHA256 source: Quote35664776.exe
Source: Quote35664776.exe, 00000003.00000002.1331118649.0000000002D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0042C4E3 NtClose, 7_2_0042C4E3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512B60 NtClose,LdrInitializeThunk, 7_2_01512B60
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512DF0 NtQuerySystemInformation,LdrInitializeThunk, 7_2_01512DF0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512C70 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_01512C70
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015135C0 NtCreateMutant,LdrInitializeThunk, 7_2_015135C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01514340 NtSetContextThread, 7_2_01514340
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01514650 NtSuspendThread, 7_2_01514650
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512BF0 NtAllocateVirtualMemory, 7_2_01512BF0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512BE0 NtQueryValueKey, 7_2_01512BE0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512B80 NtQueryInformationFile, 7_2_01512B80
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512BA0 NtEnumerateValueKey, 7_2_01512BA0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512AD0 NtReadFile, 7_2_01512AD0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512AF0 NtWriteFile, 7_2_01512AF0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512AB0 NtWaitForSingleObject, 7_2_01512AB0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512D10 NtMapViewOfSection, 7_2_01512D10
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512D00 NtSetInformationFile, 7_2_01512D00
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512D30 NtUnmapViewOfSection, 7_2_01512D30
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512DD0 NtDelayExecution, 7_2_01512DD0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512DB0 NtEnumerateKey, 7_2_01512DB0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512C60 NtCreateKey, 7_2_01512C60
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512C00 NtQueryInformationProcess, 7_2_01512C00
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512CC0 NtQueryVirtualMemory, 7_2_01512CC0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512CF0 NtOpenProcess, 7_2_01512CF0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512CA0 NtQueryInformationToken, 7_2_01512CA0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512F60 NtCreateProcessEx, 7_2_01512F60
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512F30 NtCreateSection, 7_2_01512F30
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512FE0 NtCreateFile, 7_2_01512FE0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512F90 NtProtectVirtualMemory, 7_2_01512F90
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512FB0 NtResumeThread, 7_2_01512FB0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512FA0 NtQuerySection, 7_2_01512FA0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512E30 NtWriteVirtualMemory, 7_2_01512E30
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512EE0 NtQueueApcThread, 7_2_01512EE0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512E80 NtReadVirtualMemory, 7_2_01512E80
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512EA0 NtAdjustPrivilegesToken, 7_2_01512EA0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01513010 NtOpenDirectoryObject, 7_2_01513010
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01513090 NtSetValueKey, 7_2_01513090
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015139B0 NtGetContextThread, 7_2_015139B0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01513D70 NtOpenThread, 7_2_01513D70
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01513D10 NtOpenProcessToken, 7_2_01513D10
Detected potential crypto function
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 3_2_010CDA8C 3_2_010CDA8C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 3_2_0CC53A10 3_2_0CC53A10
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0040284A 7_2_0040284A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_00402850 7_2_00402850
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_00410093 7_2_00410093
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_00403150 7_2_00403150
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0040E113 7_2_0040E113
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0042EB03 7_2_0042EB03
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0040FE6E 7_2_0040FE6E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0040FE73 7_2_0040FE73
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_00416733 7_2_00416733
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01568158 7_2_01568158
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D0100 7_2_014D0100
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157A118 7_2_0157A118
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015981CC 7_2_015981CC
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A01AA 7_2_015A01AA
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015941A2 7_2_015941A2
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01572000 7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159A352 7_2_0159A352
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A03E6 7_2_015A03E6
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EE3F0 7_2_014EE3F0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015602C0 7_2_015602C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0535 7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A0591 7_2_015A0591
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01592446 7_2_01592446
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01584420 7_2_01584420
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0158E4F6 7_2_0158E4F6
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01504750 7_2_01504750
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DC7C0 7_2_014DC7C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FC6E0 7_2_014FC6E0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F6962 7_2_014F6962
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015AA9A6 7_2_015AA9A6
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E2840 7_2_014E2840
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EA840 7_2_014EA840
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E8F0 7_2_0150E8F0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014C68B8 7_2_014C68B8
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159AB40 7_2_0159AB40
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01596BD7 7_2_01596BD7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DEA80 7_2_014DEA80
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157CD1F 7_2_0157CD1F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EAD00 7_2_014EAD00
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DADE0 7_2_014DADE0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F8DBF 7_2_014F8DBF
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0C00 7_2_014E0C00
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D0CF2 7_2_014D0CF2
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580CB5 7_2_01580CB5
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01554F40 7_2_01554F40
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01500F30 7_2_01500F30
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01582F30 7_2_01582F30
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01522F28 7_2_01522F28
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D2FC8 7_2_014D2FC8
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014ECFE0 7_2_014ECFE0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155EFA0 7_2_0155EFA0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0E59 7_2_014E0E59
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159EE26 7_2_0159EE26
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159EEDB 7_2_0159EEDB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159CE93 7_2_0159CE93
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F2E90 7_2_014F2E90
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015AB16B 7_2_015AB16B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0151516C 7_2_0151516C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CF172 7_2_014CF172
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EB1B0 7_2_014EB1B0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E70C0 7_2_014E70C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0158F0CC 7_2_0158F0CC
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015970E9 7_2_015970E9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159F0E0 7_2_0159F0E0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CD34C 7_2_014CD34C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159132D 7_2_0159132D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0152739A 7_2_0152739A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FB2C0 7_2_014FB2C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015812ED 7_2_015812ED
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E52A0 7_2_014E52A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01597571 7_2_01597571
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A95C3 7_2_015A95C3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157D5B0 7_2_0157D5B0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D1460 7_2_014D1460
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159F43F 7_2_0159F43F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159F7B0 7_2_0159F7B0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01525630 7_2_01525630
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015916CC 7_2_015916CC
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E9950 7_2_014E9950
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FB950 7_2_014FB950
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01575910 7_2_01575910
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154D800 7_2_0154D800
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E38E0 7_2_014E38E0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159FB76 7_2_0159FB76
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01555BF0 7_2_01555BF0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0151DBF9 7_2_0151DBF9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FFB80 7_2_014FFB80
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159FA49 7_2_0159FA49
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01597A46 7_2_01597A46
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01553A6C 7_2_01553A6C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0158DAC6 7_2_0158DAC6
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01525AA0 7_2_01525AA0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157DAAC 7_2_0157DAAC
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01581AA3 7_2_01581AA3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01591D5A 7_2_01591D5A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E3D40 7_2_014E3D40
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01597D73 7_2_01597D73
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FFDC0 7_2_014FFDC0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01559C32 7_2_01559C32
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159FCF2 7_2_0159FCF2
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159FF09 7_2_0159FF09
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014A3FD2 7_2_014A3FD2
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014A3FD5 7_2_014A3FD5
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E1F92 7_2_014E1F92
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159FFB1 7_2_0159FFB1
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E9EB0 7_2_014E9EB0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: String function: 01515130 appears 58 times
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: String function: 0155F290 appears 105 times
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: String function: 014CB970 appears 277 times
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: String function: 0154EA12 appears 86 times
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: String function: 01527E54 appears 111 times
Sample file is different than original file name gathered from version info
Source: Quote35664776.exe, 00000003.00000002.1339818113.0000000009BC0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Quote35664776.exe
Source: Quote35664776.exe, 00000003.00000002.1306406310.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Quote35664776.exe
Source: Quote35664776.exe, 00000003.00000000.1280871170.0000000000736000.00000002.00000001.01000000.00000004.sdmp Binary or memory string: OriginalFilenameyjvR.exe6 vs Quote35664776.exe
Source: Quote35664776.exe, 00000007.00000002.1359717433.00000000015CD000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Quote35664776.exe
Source: Quote35664776.exe Binary or memory string: OriginalFilenameyjvR.exe6 vs Quote35664776.exe
Uses 32bit PE files
Source: Quote35664776.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Quote35664776.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, x6cK73VO5rSrjlo76X.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Sok1NDXnWLr75Px8nU.cs Security API names: _0020.SetAccessControl
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Sok1NDXnWLr75Px8nU.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Sok1NDXnWLr75Px8nU.cs Security API names: _0020.AddAccessRule
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Sok1NDXnWLr75Px8nU.cs Security API names: _0020.SetAccessControl
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Sok1NDXnWLr75Px8nU.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Sok1NDXnWLr75Px8nU.cs Security API names: _0020.AddAccessRule
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, x6cK73VO5rSrjlo76X.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, x6cK73VO5rSrjlo76X.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Sok1NDXnWLr75Px8nU.cs Security API names: _0020.SetAccessControl
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Sok1NDXnWLr75Px8nU.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Sok1NDXnWLr75Px8nU.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/6@0/0
Source: C:\Users\user\Desktop\Quote35664776.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quote35664776.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7308:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_auxzxpwz.0ck.ps1 Jump to behavior
Source: Quote35664776.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Quote35664776.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Quote35664776.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Quote35664776.exe ReversingLabs: Detection: 42%
Source: Quote35664776.exe String found in binary or memory: $8ef8c825-4d3b-4232-add3-f59032e3b409
Source: unknown Process created: C:\Users\user\Desktop\Quote35664776.exe "C:\Users\user\Desktop\Quote35664776.exe"
Source: C:\Users\user\Desktop\Quote35664776.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote35664776.exe"
Source: C:\Users\user\Desktop\Quote35664776.exe Process created: C:\Users\user\Desktop\Quote35664776.exe "C:\Users\user\Desktop\Quote35664776.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\Quote35664776.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote35664776.exe" Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process created: C:\Users\user\Desktop\Quote35664776.exe "C:\Users\user\Desktop\Quote35664776.exe" Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Quote35664776.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Quote35664776.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Quote35664776.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Quote35664776.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wntdll.pdbUGP source: Quote35664776.exe, 00000007.00000002.1359717433.00000000014A0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: Quote35664776.exe, Quote35664776.exe, 00000007.00000002.1359717433.00000000014A0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: yjvR.pdb source: Quote35664776.exe
Source: Binary string: yjvR.pdbSHA256 source: Quote35664776.exe

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: Quote35664776.exe, frmMain.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: Quote35664776.exe, frmMain.cs .Net Code: InitializeComponent
Source: 3.2.Quote35664776.exe.3ac0b90.0.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Sok1NDXnWLr75Px8nU.cs .Net Code: Qy11SmBiIl System.Reflection.Assembly.Load(byte[])
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Sok1NDXnWLr75Px8nU.cs .Net Code: Qy11SmBiIl System.Reflection.Assembly.Load(byte[])
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Sok1NDXnWLr75Px8nU.cs .Net Code: Qy11SmBiIl System.Reflection.Assembly.Load(byte[])
Source: 3.2.Quote35664776.exe.5270000.3.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: Quote35664776.exe Static PE information: 0x89636CF8 [Fri Jan 16 04:15:52 2043 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0041F0D1 push ebp; iretd 7_2_0041F0DA
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_004118F3 push esp; iretd 7_2_00411926
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_004118B0 push esp; iretd 7_2_00411926
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0041B2EA pushfd ; retf 7_2_0041B2ED
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_004033D0 push eax; ret 7_2_004033D2
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0040BCC7 push C1009F53h; ret 7_2_0040BCCE
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_00406567 push edx; iretd 7_2_00406568
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_004165BD pushfd ; retf 7_2_004165C1
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0040863B push ebx; iretd 7_2_0040863C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0041E74B push ds; iretd 7_2_0041E74C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014A225F pushad ; ret 7_2_014A27F9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014A27FA pushad ; ret 7_2_014A27F9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D09AD push ecx; mov dword ptr [esp], ecx 7_2_014D09B6
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014A283D push eax; iretd 7_2_014A2858
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014A135E push eax; iretd 7_2_014A1369
Source: Quote35664776.exe Static PE information: section name: .text entropy: 7.977991168390122
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, x6cK73VO5rSrjlo76X.cs High entropy of concatenated method names: 'TQsPny76uP', 'SbePZE6Mfh', 'jOXPuGTfHo', 'B5YPawatgb', 'WOrPLv2iHX', 'uJwPhopWer', 'oKFPwC6E9i', 'j2qP3CIG7J', 'hUSP6JvV92', 'd0jPEbrVmV'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, rFLhHkFC8SefOnqKOq2.cs High entropy of concatenated method names: 'm7GINcdEq5', 'HmpIFKDHCE', 'F4JISsZ4Le', 'PBYIbZHiqX', 'pGDIgbTvxR', 'vXsIeB42gm', 'U8dI0JgbIZ', 'O6oIYSIv5o', 'PStIAhM343', 'E3kIvFFOD9'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Sok1NDXnWLr75Px8nU.cs High entropy of concatenated method names: 'Nww7sb97WO', 'IqA7rRAUn6', 'RTr7P81epm', 'RsQ7cNkkIb', 'A6N7G8gVib', 'vyj7xSE4Ot', 'SKu7iOcdCI', 'H3m7Vet7HY', 'cWO7pIkvnI', 'IhF75bdBEb'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, HZ68fDib74Ymn7KC6t.cs High entropy of concatenated method names: 'tLqIXJhXfm', 'LkHI7XTrsi', 'HQ5I1a1loi', 'k7MIrdgF88', 'L3LIPOpIVP', 'siqIGbiIxf', 'Io9IxpXOFc', 'WSWUwsnrTa', 'BedU3a4L1c', 'M18U6yFKq7'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, bs2fgozyYvXB1H4niC.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QwHIBmFJs9', 'QSTIkuJ6og', 'gicIykCkQX', 'xGMIDdc9da', 'UqTIUvjvl4', 'gBYIIYJr5J', 'WgiIOUWPtx'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, bA9RTfZIChuDRqfLHK.cs High entropy of concatenated method names: 'TsCxsnGHwO', 'OTcxP6ioLA', 'WCuxGYAqCa', 'QHIxiwRj6P', 'DUqxVpMfbf', 'hAEGLN45hs', 'xkPGhWvnqp', 'cFLGwWTMOn', 'mCmG3o6kjn', 'YdeG6DvAqT'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, vAn0HoArA23Maefiap.cs High entropy of concatenated method names: 'BEtcbdZ8BK', 'mBxceDM8GV', 'rvccYniltf', 'PKucA0Hneh', 'IdQcke2hU3', 'iuncyssD0S', 't6lcDhlKvB', 'IxYcUI3Meq', 'tpMcIbrMft', 'QracOxAaOg'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, SW8DeeB6aVHGjqOFRf.cs High entropy of concatenated method names: 'smVUrYns7P', 'esLUPjmHUp', 'osfUcvjLvM', 'oHTUGrxCY4', 'Y2XUxqM7Bh', 'xEuUiS06XZ', 'eXyUVRqitd', 'MvfUpetVpR', 'pG5U5Uu3AB', 'k6HUo1ruHH'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, LrDp2gPDDKXhK6nGRi.cs High entropy of concatenated method names: 'BfFBYAM7ks', 'APTBAFO9pD', 'qtbBTB0oOK', 'd6NBdMnkb9', 'C0dBfHLt9e', 'r5lBHpy8dj', 'TMmB9k7q8c', 'rDrBJmX3RA', 'yZSBRKCB3D', 'Bh1B8EiMdw'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, pINXIehvWXwyqsnbgr.cs High entropy of concatenated method names: 'j0eXiGkS4B', 'WE5XVX4qFr', 'iVmX578VTs', 'VYgXofu2ZN', 'm64XkeuXTx', 'fTHXyNcQ1u', 'WURla1957MyhsF3ELX', 'euhib6kbWrXOlCseQd', 'p9GXXjqfrU', 'u0nX7AtSqw'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, bAfoyn70OPLcRmMWLY.cs High entropy of concatenated method names: 'XiLUTV9Q7D', 'I9IUdGnRrB', 'riEUWrvEyN', 'vjTUfEUjo1', 'dCOUnFR6hV', 'QmfUHbl9Ts', 'Next', 'Next', 'Next', 'NextBytes'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, A6o9CQUC8uU9J0HUNg.cs High entropy of concatenated method names: 'X4GirPfnY9', 'mvDicx1sBU', 'MERix8dQWZ', 'o1gxERdKxr', 'zKIxzeKlcw', 'mkfiQaFUjC', 'DhxiXr1oXg', 'rJhiC1Nw3T', 'tZoi7GC7Zh', 'uMsi1l8pmq'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Q52MZZGMumw2JdOafM.cs High entropy of concatenated method names: 'l2UD3EJiRk', 'swCDEOfvFm', 'MU7UQD2lG3', 'oj7UXPKs4T', 'lSiD8kY3WS', 'XY4DK7N7YQ', 'B7nDjCXbcp', 'Ul6DnV5EdX', 'qpDDZHQA9L', 'MujDuJtGJY'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, YPyR0rScyFQHt4LSxI.cs High entropy of concatenated method names: 'IF7SOoKod', 'VxIbiYaZ3', 'bSFe3XdW6', 'a7i0xcD7o', 'OSAADwIuL', 'zJkv5Y2yA', 'yoHpMMT5JH0jEHZcuE', 'vnC6nAJA6jemhhOKx6', 'q0YUL4s7G', 'ipSO6UrwS'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, VPTB9Hj1KQYmwFwebe.cs High entropy of concatenated method names: 'zbCxuQglUr', 'kYuxa7IBa8', 'RIoxL4uDRY', 'ToString', 'tKVxhl70Ti', 'P5dxwuKL2A', 'bdVNOCeCcMocE4bpyn5', 'oN01BCe05Bl6IXl1nfB', 'l5XgpSe54nY59H2KsBi', 'tOVTOQe1SsWQ8HlWL4V'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, auGahYmrbOXQpKrlGf.cs High entropy of concatenated method names: 'q5wkRYNSlj', 'CJkkK0g6In', 'Wu1kn607Wt', 'JqhkZj4gN1', 'oN2kdKUevq', 'nHbkWCC6Rh', 'I4Ukf1XC2h', 'sfnkHh6gbw', 'ck4k4U6gGO', 'r1qk9yrPPp'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, syv7QdNKtKblnuuuxd.cs High entropy of concatenated method names: 'n6JGgvBfBc', 'WyeG0jS8VD', 'toncWaaqaK', 'ryAcf7Tv6W', 'EJQcH9DjBF', 'jONc4schkH', 'g1Dc90c0iV', 'Dt2cJnitZx', 'Mx7cmivFXr', 'gjKcRWLAh4'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, SbBo3aTf4cNGFXq9s0.cs High entropy of concatenated method names: 'cy0iNyYDXo', 'wsiiFxWRwt', 'DyTiSQtMO3', 's4xibu9GTp', 'MumigNNe82', 'E8Die6JJ0T', 'Sf4i0KijoF', 'aeLiY01KNP', 'w92iA8FhrJ', 'KDlivZS8Eh'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, u2YxUHxItJFpKQdbGU.cs High entropy of concatenated method names: 'ToString', 'ejjy86Wpgx', 'dumydcR8nU', 'EjbyWFgZEe', 'z0Vyfmw7oU', 'vmbyHvjoGV', 'hD9y4BaQQF', 'lRny9yuOHw', 'nIhyJV3ASg', 'FvJymXBY1G'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, R8F35CDOHwNew9N6HY.cs High entropy of concatenated method names: 'Dispose', 'bLhX6xDWY1', 'HhNCdHkkuR', 'QkJqq8Tk0q', 'WwLXEaG89i', 'bRNXzsb5yg', 'ProcessDialogKey', 'C3RCQRqA7L', 'TkHCXaPEYI', 'NQYCCkRIvR'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Omg99GFnvJiuifGl2TV.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RL6OnckV1V', 'I3qOZooGr0', 'IUZOuRFDZR', 'qC5OaVVAKs', 'UMDOLS2ElB', 'z6FOhPgT43', 'LnROwXhZcl'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, x6cK73VO5rSrjlo76X.cs High entropy of concatenated method names: 'TQsPny76uP', 'SbePZE6Mfh', 'jOXPuGTfHo', 'B5YPawatgb', 'WOrPLv2iHX', 'uJwPhopWer', 'oKFPwC6E9i', 'j2qP3CIG7J', 'hUSP6JvV92', 'd0jPEbrVmV'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, rFLhHkFC8SefOnqKOq2.cs High entropy of concatenated method names: 'm7GINcdEq5', 'HmpIFKDHCE', 'F4JISsZ4Le', 'PBYIbZHiqX', 'pGDIgbTvxR', 'vXsIeB42gm', 'U8dI0JgbIZ', 'O6oIYSIv5o', 'PStIAhM343', 'E3kIvFFOD9'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Sok1NDXnWLr75Px8nU.cs High entropy of concatenated method names: 'Nww7sb97WO', 'IqA7rRAUn6', 'RTr7P81epm', 'RsQ7cNkkIb', 'A6N7G8gVib', 'vyj7xSE4Ot', 'SKu7iOcdCI', 'H3m7Vet7HY', 'cWO7pIkvnI', 'IhF75bdBEb'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, HZ68fDib74Ymn7KC6t.cs High entropy of concatenated method names: 'tLqIXJhXfm', 'LkHI7XTrsi', 'HQ5I1a1loi', 'k7MIrdgF88', 'L3LIPOpIVP', 'siqIGbiIxf', 'Io9IxpXOFc', 'WSWUwsnrTa', 'BedU3a4L1c', 'M18U6yFKq7'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, bs2fgozyYvXB1H4niC.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QwHIBmFJs9', 'QSTIkuJ6og', 'gicIykCkQX', 'xGMIDdc9da', 'UqTIUvjvl4', 'gBYIIYJr5J', 'WgiIOUWPtx'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, bA9RTfZIChuDRqfLHK.cs High entropy of concatenated method names: 'TsCxsnGHwO', 'OTcxP6ioLA', 'WCuxGYAqCa', 'QHIxiwRj6P', 'DUqxVpMfbf', 'hAEGLN45hs', 'xkPGhWvnqp', 'cFLGwWTMOn', 'mCmG3o6kjn', 'YdeG6DvAqT'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, vAn0HoArA23Maefiap.cs High entropy of concatenated method names: 'BEtcbdZ8BK', 'mBxceDM8GV', 'rvccYniltf', 'PKucA0Hneh', 'IdQcke2hU3', 'iuncyssD0S', 't6lcDhlKvB', 'IxYcUI3Meq', 'tpMcIbrMft', 'QracOxAaOg'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, SW8DeeB6aVHGjqOFRf.cs High entropy of concatenated method names: 'smVUrYns7P', 'esLUPjmHUp', 'osfUcvjLvM', 'oHTUGrxCY4', 'Y2XUxqM7Bh', 'xEuUiS06XZ', 'eXyUVRqitd', 'MvfUpetVpR', 'pG5U5Uu3AB', 'k6HUo1ruHH'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, LrDp2gPDDKXhK6nGRi.cs High entropy of concatenated method names: 'BfFBYAM7ks', 'APTBAFO9pD', 'qtbBTB0oOK', 'd6NBdMnkb9', 'C0dBfHLt9e', 'r5lBHpy8dj', 'TMmB9k7q8c', 'rDrBJmX3RA', 'yZSBRKCB3D', 'Bh1B8EiMdw'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, pINXIehvWXwyqsnbgr.cs High entropy of concatenated method names: 'j0eXiGkS4B', 'WE5XVX4qFr', 'iVmX578VTs', 'VYgXofu2ZN', 'm64XkeuXTx', 'fTHXyNcQ1u', 'WURla1957MyhsF3ELX', 'euhib6kbWrXOlCseQd', 'p9GXXjqfrU', 'u0nX7AtSqw'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, bAfoyn70OPLcRmMWLY.cs High entropy of concatenated method names: 'XiLUTV9Q7D', 'I9IUdGnRrB', 'riEUWrvEyN', 'vjTUfEUjo1', 'dCOUnFR6hV', 'QmfUHbl9Ts', 'Next', 'Next', 'Next', 'NextBytes'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, A6o9CQUC8uU9J0HUNg.cs High entropy of concatenated method names: 'X4GirPfnY9', 'mvDicx1sBU', 'MERix8dQWZ', 'o1gxERdKxr', 'zKIxzeKlcw', 'mkfiQaFUjC', 'DhxiXr1oXg', 'rJhiC1Nw3T', 'tZoi7GC7Zh', 'uMsi1l8pmq'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Q52MZZGMumw2JdOafM.cs High entropy of concatenated method names: 'l2UD3EJiRk', 'swCDEOfvFm', 'MU7UQD2lG3', 'oj7UXPKs4T', 'lSiD8kY3WS', 'XY4DK7N7YQ', 'B7nDjCXbcp', 'Ul6DnV5EdX', 'qpDDZHQA9L', 'MujDuJtGJY'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, YPyR0rScyFQHt4LSxI.cs High entropy of concatenated method names: 'IF7SOoKod', 'VxIbiYaZ3', 'bSFe3XdW6', 'a7i0xcD7o', 'OSAADwIuL', 'zJkv5Y2yA', 'yoHpMMT5JH0jEHZcuE', 'vnC6nAJA6jemhhOKx6', 'q0YUL4s7G', 'ipSO6UrwS'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, VPTB9Hj1KQYmwFwebe.cs High entropy of concatenated method names: 'zbCxuQglUr', 'kYuxa7IBa8', 'RIoxL4uDRY', 'ToString', 'tKVxhl70Ti', 'P5dxwuKL2A', 'bdVNOCeCcMocE4bpyn5', 'oN01BCe05Bl6IXl1nfB', 'l5XgpSe54nY59H2KsBi', 'tOVTOQe1SsWQ8HlWL4V'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, auGahYmrbOXQpKrlGf.cs High entropy of concatenated method names: 'q5wkRYNSlj', 'CJkkK0g6In', 'Wu1kn607Wt', 'JqhkZj4gN1', 'oN2kdKUevq', 'nHbkWCC6Rh', 'I4Ukf1XC2h', 'sfnkHh6gbw', 'ck4k4U6gGO', 'r1qk9yrPPp'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, syv7QdNKtKblnuuuxd.cs High entropy of concatenated method names: 'n6JGgvBfBc', 'WyeG0jS8VD', 'toncWaaqaK', 'ryAcf7Tv6W', 'EJQcH9DjBF', 'jONc4schkH', 'g1Dc90c0iV', 'Dt2cJnitZx', 'Mx7cmivFXr', 'gjKcRWLAh4'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, SbBo3aTf4cNGFXq9s0.cs High entropy of concatenated method names: 'cy0iNyYDXo', 'wsiiFxWRwt', 'DyTiSQtMO3', 's4xibu9GTp', 'MumigNNe82', 'E8Die6JJ0T', 'Sf4i0KijoF', 'aeLiY01KNP', 'w92iA8FhrJ', 'KDlivZS8Eh'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, u2YxUHxItJFpKQdbGU.cs High entropy of concatenated method names: 'ToString', 'ejjy86Wpgx', 'dumydcR8nU', 'EjbyWFgZEe', 'z0Vyfmw7oU', 'vmbyHvjoGV', 'hD9y4BaQQF', 'lRny9yuOHw', 'nIhyJV3ASg', 'FvJymXBY1G'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, R8F35CDOHwNew9N6HY.cs High entropy of concatenated method names: 'Dispose', 'bLhX6xDWY1', 'HhNCdHkkuR', 'QkJqq8Tk0q', 'WwLXEaG89i', 'bRNXzsb5yg', 'ProcessDialogKey', 'C3RCQRqA7L', 'TkHCXaPEYI', 'NQYCCkRIvR'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Omg99GFnvJiuifGl2TV.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RL6OnckV1V', 'I3qOZooGr0', 'IUZOuRFDZR', 'qC5OaVVAKs', 'UMDOLS2ElB', 'z6FOhPgT43', 'LnROwXhZcl'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, x6cK73VO5rSrjlo76X.cs High entropy of concatenated method names: 'TQsPny76uP', 'SbePZE6Mfh', 'jOXPuGTfHo', 'B5YPawatgb', 'WOrPLv2iHX', 'uJwPhopWer', 'oKFPwC6E9i', 'j2qP3CIG7J', 'hUSP6JvV92', 'd0jPEbrVmV'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, rFLhHkFC8SefOnqKOq2.cs High entropy of concatenated method names: 'm7GINcdEq5', 'HmpIFKDHCE', 'F4JISsZ4Le', 'PBYIbZHiqX', 'pGDIgbTvxR', 'vXsIeB42gm', 'U8dI0JgbIZ', 'O6oIYSIv5o', 'PStIAhM343', 'E3kIvFFOD9'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Sok1NDXnWLr75Px8nU.cs High entropy of concatenated method names: 'Nww7sb97WO', 'IqA7rRAUn6', 'RTr7P81epm', 'RsQ7cNkkIb', 'A6N7G8gVib', 'vyj7xSE4Ot', 'SKu7iOcdCI', 'H3m7Vet7HY', 'cWO7pIkvnI', 'IhF75bdBEb'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, HZ68fDib74Ymn7KC6t.cs High entropy of concatenated method names: 'tLqIXJhXfm', 'LkHI7XTrsi', 'HQ5I1a1loi', 'k7MIrdgF88', 'L3LIPOpIVP', 'siqIGbiIxf', 'Io9IxpXOFc', 'WSWUwsnrTa', 'BedU3a4L1c', 'M18U6yFKq7'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, bs2fgozyYvXB1H4niC.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QwHIBmFJs9', 'QSTIkuJ6og', 'gicIykCkQX', 'xGMIDdc9da', 'UqTIUvjvl4', 'gBYIIYJr5J', 'WgiIOUWPtx'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, bA9RTfZIChuDRqfLHK.cs High entropy of concatenated method names: 'TsCxsnGHwO', 'OTcxP6ioLA', 'WCuxGYAqCa', 'QHIxiwRj6P', 'DUqxVpMfbf', 'hAEGLN45hs', 'xkPGhWvnqp', 'cFLGwWTMOn', 'mCmG3o6kjn', 'YdeG6DvAqT'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, vAn0HoArA23Maefiap.cs High entropy of concatenated method names: 'BEtcbdZ8BK', 'mBxceDM8GV', 'rvccYniltf', 'PKucA0Hneh', 'IdQcke2hU3', 'iuncyssD0S', 't6lcDhlKvB', 'IxYcUI3Meq', 'tpMcIbrMft', 'QracOxAaOg'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, SW8DeeB6aVHGjqOFRf.cs High entropy of concatenated method names: 'smVUrYns7P', 'esLUPjmHUp', 'osfUcvjLvM', 'oHTUGrxCY4', 'Y2XUxqM7Bh', 'xEuUiS06XZ', 'eXyUVRqitd', 'MvfUpetVpR', 'pG5U5Uu3AB', 'k6HUo1ruHH'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, LrDp2gPDDKXhK6nGRi.cs High entropy of concatenated method names: 'BfFBYAM7ks', 'APTBAFO9pD', 'qtbBTB0oOK', 'd6NBdMnkb9', 'C0dBfHLt9e', 'r5lBHpy8dj', 'TMmB9k7q8c', 'rDrBJmX3RA', 'yZSBRKCB3D', 'Bh1B8EiMdw'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, pINXIehvWXwyqsnbgr.cs High entropy of concatenated method names: 'j0eXiGkS4B', 'WE5XVX4qFr', 'iVmX578VTs', 'VYgXofu2ZN', 'm64XkeuXTx', 'fTHXyNcQ1u', 'WURla1957MyhsF3ELX', 'euhib6kbWrXOlCseQd', 'p9GXXjqfrU', 'u0nX7AtSqw'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, bAfoyn70OPLcRmMWLY.cs High entropy of concatenated method names: 'XiLUTV9Q7D', 'I9IUdGnRrB', 'riEUWrvEyN', 'vjTUfEUjo1', 'dCOUnFR6hV', 'QmfUHbl9Ts', 'Next', 'Next', 'Next', 'NextBytes'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, A6o9CQUC8uU9J0HUNg.cs High entropy of concatenated method names: 'X4GirPfnY9', 'mvDicx1sBU', 'MERix8dQWZ', 'o1gxERdKxr', 'zKIxzeKlcw', 'mkfiQaFUjC', 'DhxiXr1oXg', 'rJhiC1Nw3T', 'tZoi7GC7Zh', 'uMsi1l8pmq'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Q52MZZGMumw2JdOafM.cs High entropy of concatenated method names: 'l2UD3EJiRk', 'swCDEOfvFm', 'MU7UQD2lG3', 'oj7UXPKs4T', 'lSiD8kY3WS', 'XY4DK7N7YQ', 'B7nDjCXbcp', 'Ul6DnV5EdX', 'qpDDZHQA9L', 'MujDuJtGJY'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, YPyR0rScyFQHt4LSxI.cs High entropy of concatenated method names: 'IF7SOoKod', 'VxIbiYaZ3', 'bSFe3XdW6', 'a7i0xcD7o', 'OSAADwIuL', 'zJkv5Y2yA', 'yoHpMMT5JH0jEHZcuE', 'vnC6nAJA6jemhhOKx6', 'q0YUL4s7G', 'ipSO6UrwS'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, VPTB9Hj1KQYmwFwebe.cs High entropy of concatenated method names: 'zbCxuQglUr', 'kYuxa7IBa8', 'RIoxL4uDRY', 'ToString', 'tKVxhl70Ti', 'P5dxwuKL2A', 'bdVNOCeCcMocE4bpyn5', 'oN01BCe05Bl6IXl1nfB', 'l5XgpSe54nY59H2KsBi', 'tOVTOQe1SsWQ8HlWL4V'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, auGahYmrbOXQpKrlGf.cs High entropy of concatenated method names: 'q5wkRYNSlj', 'CJkkK0g6In', 'Wu1kn607Wt', 'JqhkZj4gN1', 'oN2kdKUevq', 'nHbkWCC6Rh', 'I4Ukf1XC2h', 'sfnkHh6gbw', 'ck4k4U6gGO', 'r1qk9yrPPp'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, syv7QdNKtKblnuuuxd.cs High entropy of concatenated method names: 'n6JGgvBfBc', 'WyeG0jS8VD', 'toncWaaqaK', 'ryAcf7Tv6W', 'EJQcH9DjBF', 'jONc4schkH', 'g1Dc90c0iV', 'Dt2cJnitZx', 'Mx7cmivFXr', 'gjKcRWLAh4'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, SbBo3aTf4cNGFXq9s0.cs High entropy of concatenated method names: 'cy0iNyYDXo', 'wsiiFxWRwt', 'DyTiSQtMO3', 's4xibu9GTp', 'MumigNNe82', 'E8Die6JJ0T', 'Sf4i0KijoF', 'aeLiY01KNP', 'w92iA8FhrJ', 'KDlivZS8Eh'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, u2YxUHxItJFpKQdbGU.cs High entropy of concatenated method names: 'ToString', 'ejjy86Wpgx', 'dumydcR8nU', 'EjbyWFgZEe', 'z0Vyfmw7oU', 'vmbyHvjoGV', 'hD9y4BaQQF', 'lRny9yuOHw', 'nIhyJV3ASg', 'FvJymXBY1G'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, R8F35CDOHwNew9N6HY.cs High entropy of concatenated method names: 'Dispose', 'bLhX6xDWY1', 'HhNCdHkkuR', 'QkJqq8Tk0q', 'WwLXEaG89i', 'bRNXzsb5yg', 'ProcessDialogKey', 'C3RCQRqA7L', 'TkHCXaPEYI', 'NQYCCkRIvR'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Omg99GFnvJiuifGl2TV.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RL6OnckV1V', 'I3qOZooGr0', 'IUZOuRFDZR', 'qC5OaVVAKs', 'UMDOLS2ElB', 'z6FOhPgT43', 'LnROwXhZcl'

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Quote35664776.exe PID: 6448, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Quote35664776.exe Memory allocated: 10C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Memory allocated: 2AA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Memory allocated: 4AA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Memory allocated: 6FE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Memory allocated: 7FE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Memory allocated: 8160000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Memory allocated: 9160000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Memory allocated: 9C50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Memory allocated: AC50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Memory allocated: BC50000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0151096E rdtsc 7_2_0151096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Quote35664776.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5152 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3000 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\Quote35664776.exe API coverage: 0.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Quote35664776.exe TID: 6240 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7428 Thread sleep time: -11068046444225724s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7408 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe TID: 7304 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Quote35664776.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0151096E rdtsc 7_2_0151096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_004176E3 LdrLoadDll, 7_2_004176E3
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01568158 mov eax, dword ptr fs:[00000030h] 7_2_01568158
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01564144 mov eax, dword ptr fs:[00000030h] 7_2_01564144
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01564144 mov eax, dword ptr fs:[00000030h] 7_2_01564144
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01564144 mov ecx, dword ptr fs:[00000030h] 7_2_01564144
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01564144 mov eax, dword ptr fs:[00000030h] 7_2_01564144
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01564144 mov eax, dword ptr fs:[00000030h] 7_2_01564144
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D6154 mov eax, dword ptr fs:[00000030h] 7_2_014D6154
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D6154 mov eax, dword ptr fs:[00000030h] 7_2_014D6154
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CC156 mov eax, dword ptr fs:[00000030h] 7_2_014CC156
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A4164 mov eax, dword ptr fs:[00000030h] 7_2_015A4164
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A4164 mov eax, dword ptr fs:[00000030h] 7_2_015A4164
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01590115 mov eax, dword ptr fs:[00000030h] 7_2_01590115
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157A118 mov ecx, dword ptr fs:[00000030h] 7_2_0157A118
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157A118 mov eax, dword ptr fs:[00000030h] 7_2_0157A118
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157A118 mov eax, dword ptr fs:[00000030h] 7_2_0157A118
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157A118 mov eax, dword ptr fs:[00000030h] 7_2_0157A118
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h] 7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E10E mov ecx, dword ptr fs:[00000030h] 7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h] 7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h] 7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E10E mov ecx, dword ptr fs:[00000030h] 7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h] 7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h] 7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E10E mov ecx, dword ptr fs:[00000030h] 7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h] 7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E10E mov ecx, dword ptr fs:[00000030h] 7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01500124 mov eax, dword ptr fs:[00000030h] 7_2_01500124
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E1D0 mov eax, dword ptr fs:[00000030h] 7_2_0154E1D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E1D0 mov eax, dword ptr fs:[00000030h] 7_2_0154E1D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E1D0 mov ecx, dword ptr fs:[00000030h] 7_2_0154E1D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E1D0 mov eax, dword ptr fs:[00000030h] 7_2_0154E1D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E1D0 mov eax, dword ptr fs:[00000030h] 7_2_0154E1D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015961C3 mov eax, dword ptr fs:[00000030h] 7_2_015961C3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015961C3 mov eax, dword ptr fs:[00000030h] 7_2_015961C3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015001F8 mov eax, dword ptr fs:[00000030h] 7_2_015001F8
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A61E5 mov eax, dword ptr fs:[00000030h] 7_2_015A61E5
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155019F mov eax, dword ptr fs:[00000030h] 7_2_0155019F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155019F mov eax, dword ptr fs:[00000030h] 7_2_0155019F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155019F mov eax, dword ptr fs:[00000030h] 7_2_0155019F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155019F mov eax, dword ptr fs:[00000030h] 7_2_0155019F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0158C188 mov eax, dword ptr fs:[00000030h] 7_2_0158C188
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0158C188 mov eax, dword ptr fs:[00000030h] 7_2_0158C188
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01510185 mov eax, dword ptr fs:[00000030h] 7_2_01510185
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01574180 mov eax, dword ptr fs:[00000030h] 7_2_01574180
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01574180 mov eax, dword ptr fs:[00000030h] 7_2_01574180
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CA197 mov eax, dword ptr fs:[00000030h] 7_2_014CA197
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CA197 mov eax, dword ptr fs:[00000030h] 7_2_014CA197
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CA197 mov eax, dword ptr fs:[00000030h] 7_2_014CA197
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01556050 mov eax, dword ptr fs:[00000030h] 7_2_01556050
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D2050 mov eax, dword ptr fs:[00000030h] 7_2_014D2050
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FC073 mov eax, dword ptr fs:[00000030h] 7_2_014FC073
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01554000 mov ecx, dword ptr fs:[00000030h] 7_2_01554000
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h] 7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h] 7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h] 7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h] 7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h] 7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h] 7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h] 7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h] 7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EE016 mov eax, dword ptr fs:[00000030h] 7_2_014EE016
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EE016 mov eax, dword ptr fs:[00000030h] 7_2_014EE016
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EE016 mov eax, dword ptr fs:[00000030h] 7_2_014EE016
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EE016 mov eax, dword ptr fs:[00000030h] 7_2_014EE016
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01566030 mov eax, dword ptr fs:[00000030h] 7_2_01566030
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CA020 mov eax, dword ptr fs:[00000030h] 7_2_014CA020
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CC020 mov eax, dword ptr fs:[00000030h] 7_2_014CC020
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015520DE mov eax, dword ptr fs:[00000030h] 7_2_015520DE
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015120F0 mov ecx, dword ptr fs:[00000030h] 7_2_015120F0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D80E9 mov eax, dword ptr fs:[00000030h] 7_2_014D80E9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CA0E3 mov ecx, dword ptr fs:[00000030h] 7_2_014CA0E3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015560E0 mov eax, dword ptr fs:[00000030h] 7_2_015560E0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CC0F0 mov eax, dword ptr fs:[00000030h] 7_2_014CC0F0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D208A mov eax, dword ptr fs:[00000030h] 7_2_014D208A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015960B8 mov eax, dword ptr fs:[00000030h] 7_2_015960B8
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015960B8 mov ecx, dword ptr fs:[00000030h] 7_2_015960B8
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014C80A0 mov eax, dword ptr fs:[00000030h] 7_2_014C80A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015680A8 mov eax, dword ptr fs:[00000030h] 7_2_015680A8
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01578350 mov ecx, dword ptr fs:[00000030h] 7_2_01578350
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155035C mov eax, dword ptr fs:[00000030h] 7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155035C mov eax, dword ptr fs:[00000030h] 7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155035C mov eax, dword ptr fs:[00000030h] 7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155035C mov ecx, dword ptr fs:[00000030h] 7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155035C mov eax, dword ptr fs:[00000030h] 7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155035C mov eax, dword ptr fs:[00000030h] 7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159A352 mov eax, dword ptr fs:[00000030h] 7_2_0159A352
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A634F mov eax, dword ptr fs:[00000030h] 7_2_015A634F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h] 7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157437C mov eax, dword ptr fs:[00000030h] 7_2_0157437C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150A30B mov eax, dword ptr fs:[00000030h] 7_2_0150A30B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150A30B mov eax, dword ptr fs:[00000030h] 7_2_0150A30B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150A30B mov eax, dword ptr fs:[00000030h] 7_2_0150A30B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CC310 mov ecx, dword ptr fs:[00000030h] 7_2_014CC310
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F0310 mov ecx, dword ptr fs:[00000030h] 7_2_014F0310
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A8324 mov eax, dword ptr fs:[00000030h] 7_2_015A8324
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A8324 mov ecx, dword ptr fs:[00000030h] 7_2_015A8324
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A8324 mov eax, dword ptr fs:[00000030h] 7_2_015A8324
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A8324 mov eax, dword ptr fs:[00000030h] 7_2_015A8324
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015743D4 mov eax, dword ptr fs:[00000030h] 7_2_015743D4
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015743D4 mov eax, dword ptr fs:[00000030h] 7_2_015743D4
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E3DB mov eax, dword ptr fs:[00000030h] 7_2_0157E3DB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E3DB mov eax, dword ptr fs:[00000030h] 7_2_0157E3DB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E3DB mov ecx, dword ptr fs:[00000030h] 7_2_0157E3DB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157E3DB mov eax, dword ptr fs:[00000030h] 7_2_0157E3DB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h] 7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h] 7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h] 7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h] 7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h] 7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h] 7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D83C0 mov eax, dword ptr fs:[00000030h] 7_2_014D83C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D83C0 mov eax, dword ptr fs:[00000030h] 7_2_014D83C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D83C0 mov eax, dword ptr fs:[00000030h] 7_2_014D83C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D83C0 mov eax, dword ptr fs:[00000030h] 7_2_014D83C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0158C3CD mov eax, dword ptr fs:[00000030h] 7_2_0158C3CD
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015563C0 mov eax, dword ptr fs:[00000030h] 7_2_015563C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h] 7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h] 7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h] 7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h] 7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h] 7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h] 7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h] 7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h] 7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015063FF mov eax, dword ptr fs:[00000030h] 7_2_015063FF
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EE3F0 mov eax, dword ptr fs:[00000030h] 7_2_014EE3F0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EE3F0 mov eax, dword ptr fs:[00000030h] 7_2_014EE3F0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EE3F0 mov eax, dword ptr fs:[00000030h] 7_2_014EE3F0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F438F mov eax, dword ptr fs:[00000030h] 7_2_014F438F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F438F mov eax, dword ptr fs:[00000030h] 7_2_014F438F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CE388 mov eax, dword ptr fs:[00000030h] 7_2_014CE388
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CE388 mov eax, dword ptr fs:[00000030h] 7_2_014CE388
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CE388 mov eax, dword ptr fs:[00000030h] 7_2_014CE388
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014C8397 mov eax, dword ptr fs:[00000030h] 7_2_014C8397
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014C8397 mov eax, dword ptr fs:[00000030h] 7_2_014C8397
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014C8397 mov eax, dword ptr fs:[00000030h] 7_2_014C8397
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A625D mov eax, dword ptr fs:[00000030h] 7_2_015A625D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0158A250 mov eax, dword ptr fs:[00000030h] 7_2_0158A250
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0158A250 mov eax, dword ptr fs:[00000030h] 7_2_0158A250
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D6259 mov eax, dword ptr fs:[00000030h] 7_2_014D6259
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01558243 mov eax, dword ptr fs:[00000030h] 7_2_01558243
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01558243 mov ecx, dword ptr fs:[00000030h] 7_2_01558243
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CA250 mov eax, dword ptr fs:[00000030h] 7_2_014CA250
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014C826B mov eax, dword ptr fs:[00000030h] 7_2_014C826B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h] 7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D4260 mov eax, dword ptr fs:[00000030h] 7_2_014D4260
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D4260 mov eax, dword ptr fs:[00000030h] 7_2_014D4260
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D4260 mov eax, dword ptr fs:[00000030h] 7_2_014D4260
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014C823B mov eax, dword ptr fs:[00000030h] 7_2_014C823B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A62D6 mov eax, dword ptr fs:[00000030h] 7_2_015A62D6
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA2C3 mov eax, dword ptr fs:[00000030h] 7_2_014DA2C3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA2C3 mov eax, dword ptr fs:[00000030h] 7_2_014DA2C3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA2C3 mov eax, dword ptr fs:[00000030h] 7_2_014DA2C3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA2C3 mov eax, dword ptr fs:[00000030h] 7_2_014DA2C3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA2C3 mov eax, dword ptr fs:[00000030h] 7_2_014DA2C3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E02E1 mov eax, dword ptr fs:[00000030h] 7_2_014E02E1
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E02E1 mov eax, dword ptr fs:[00000030h] 7_2_014E02E1
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E02E1 mov eax, dword ptr fs:[00000030h] 7_2_014E02E1
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E284 mov eax, dword ptr fs:[00000030h] 7_2_0150E284
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E284 mov eax, dword ptr fs:[00000030h] 7_2_0150E284
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01550283 mov eax, dword ptr fs:[00000030h] 7_2_01550283
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01550283 mov eax, dword ptr fs:[00000030h] 7_2_01550283
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01550283 mov eax, dword ptr fs:[00000030h] 7_2_01550283
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E02A0 mov eax, dword ptr fs:[00000030h] 7_2_014E02A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E02A0 mov eax, dword ptr fs:[00000030h] 7_2_014E02A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015662A0 mov eax, dword ptr fs:[00000030h] 7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015662A0 mov ecx, dword ptr fs:[00000030h] 7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015662A0 mov eax, dword ptr fs:[00000030h] 7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015662A0 mov eax, dword ptr fs:[00000030h] 7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015662A0 mov eax, dword ptr fs:[00000030h] 7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015662A0 mov eax, dword ptr fs:[00000030h] 7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D8550 mov eax, dword ptr fs:[00000030h] 7_2_014D8550
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D8550 mov eax, dword ptr fs:[00000030h] 7_2_014D8550
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150656A mov eax, dword ptr fs:[00000030h] 7_2_0150656A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150656A mov eax, dword ptr fs:[00000030h] 7_2_0150656A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150656A mov eax, dword ptr fs:[00000030h] 7_2_0150656A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01566500 mov eax, dword ptr fs:[00000030h] 7_2_01566500
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h] 7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h] 7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h] 7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h] 7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h] 7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h] 7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h] 7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE53E mov eax, dword ptr fs:[00000030h] 7_2_014FE53E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE53E mov eax, dword ptr fs:[00000030h] 7_2_014FE53E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE53E mov eax, dword ptr fs:[00000030h] 7_2_014FE53E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE53E mov eax, dword ptr fs:[00000030h] 7_2_014FE53E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE53E mov eax, dword ptr fs:[00000030h] 7_2_014FE53E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h] 7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h] 7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h] 7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h] 7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h] 7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h] 7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150A5D0 mov eax, dword ptr fs:[00000030h] 7_2_0150A5D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150A5D0 mov eax, dword ptr fs:[00000030h] 7_2_0150A5D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D65D0 mov eax, dword ptr fs:[00000030h] 7_2_014D65D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E5CF mov eax, dword ptr fs:[00000030h] 7_2_0150E5CF
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E5CF mov eax, dword ptr fs:[00000030h] 7_2_0150E5CF
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h] 7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h] 7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h] 7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h] 7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h] 7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h] 7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h] 7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h] 7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D25E0 mov eax, dword ptr fs:[00000030h] 7_2_014D25E0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150C5ED mov eax, dword ptr fs:[00000030h] 7_2_0150C5ED
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150C5ED mov eax, dword ptr fs:[00000030h] 7_2_0150C5ED
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E59C mov eax, dword ptr fs:[00000030h] 7_2_0150E59C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D2582 mov eax, dword ptr fs:[00000030h] 7_2_014D2582
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D2582 mov ecx, dword ptr fs:[00000030h] 7_2_014D2582
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01504588 mov eax, dword ptr fs:[00000030h] 7_2_01504588
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015505A7 mov eax, dword ptr fs:[00000030h] 7_2_015505A7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015505A7 mov eax, dword ptr fs:[00000030h] 7_2_015505A7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015505A7 mov eax, dword ptr fs:[00000030h] 7_2_015505A7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F45B1 mov eax, dword ptr fs:[00000030h] 7_2_014F45B1
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F45B1 mov eax, dword ptr fs:[00000030h] 7_2_014F45B1
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0158A456 mov eax, dword ptr fs:[00000030h] 7_2_0158A456
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014C645D mov eax, dword ptr fs:[00000030h] 7_2_014C645D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h] 7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h] 7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h] 7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h] 7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h] 7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h] 7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h] 7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h] 7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F245A mov eax, dword ptr fs:[00000030h] 7_2_014F245A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155C460 mov ecx, dword ptr fs:[00000030h] 7_2_0155C460
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FA470 mov eax, dword ptr fs:[00000030h] 7_2_014FA470
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FA470 mov eax, dword ptr fs:[00000030h] 7_2_014FA470
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FA470 mov eax, dword ptr fs:[00000030h] 7_2_014FA470
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01508402 mov eax, dword ptr fs:[00000030h] 7_2_01508402
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01508402 mov eax, dword ptr fs:[00000030h] 7_2_01508402
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01508402 mov eax, dword ptr fs:[00000030h] 7_2_01508402
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150A430 mov eax, dword ptr fs:[00000030h] 7_2_0150A430
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CC427 mov eax, dword ptr fs:[00000030h] 7_2_014CC427
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CE420 mov eax, dword ptr fs:[00000030h] 7_2_014CE420
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CE420 mov eax, dword ptr fs:[00000030h] 7_2_014CE420
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CE420 mov eax, dword ptr fs:[00000030h] 7_2_014CE420
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h] 7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h] 7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h] 7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h] 7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h] 7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h] 7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h] 7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D04E5 mov ecx, dword ptr fs:[00000030h] 7_2_014D04E5
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0158A49A mov eax, dword ptr fs:[00000030h] 7_2_0158A49A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015044B0 mov ecx, dword ptr fs:[00000030h] 7_2_015044B0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155A4B0 mov eax, dword ptr fs:[00000030h] 7_2_0155A4B0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D64AB mov eax, dword ptr fs:[00000030h] 7_2_014D64AB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01554755 mov eax, dword ptr fs:[00000030h] 7_2_01554755
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512750 mov eax, dword ptr fs:[00000030h] 7_2_01512750
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512750 mov eax, dword ptr fs:[00000030h] 7_2_01512750
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155E75D mov eax, dword ptr fs:[00000030h] 7_2_0155E75D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D0750 mov eax, dword ptr fs:[00000030h] 7_2_014D0750
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150674D mov esi, dword ptr fs:[00000030h] 7_2_0150674D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150674D mov eax, dword ptr fs:[00000030h] 7_2_0150674D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150674D mov eax, dword ptr fs:[00000030h] 7_2_0150674D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D8770 mov eax, dword ptr fs:[00000030h] 7_2_014D8770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h] 7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01500710 mov eax, dword ptr fs:[00000030h] 7_2_01500710
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150C700 mov eax, dword ptr fs:[00000030h] 7_2_0150C700
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D0710 mov eax, dword ptr fs:[00000030h] 7_2_014D0710
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154C730 mov eax, dword ptr fs:[00000030h] 7_2_0154C730
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150273C mov eax, dword ptr fs:[00000030h] 7_2_0150273C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150273C mov ecx, dword ptr fs:[00000030h] 7_2_0150273C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150273C mov eax, dword ptr fs:[00000030h] 7_2_0150273C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150C720 mov eax, dword ptr fs:[00000030h] 7_2_0150C720
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150C720 mov eax, dword ptr fs:[00000030h] 7_2_0150C720
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DC7C0 mov eax, dword ptr fs:[00000030h] 7_2_014DC7C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015507C3 mov eax, dword ptr fs:[00000030h] 7_2_015507C3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F27ED mov eax, dword ptr fs:[00000030h] 7_2_014F27ED
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F27ED mov eax, dword ptr fs:[00000030h] 7_2_014F27ED
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F27ED mov eax, dword ptr fs:[00000030h] 7_2_014F27ED
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155E7E1 mov eax, dword ptr fs:[00000030h] 7_2_0155E7E1
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D47FB mov eax, dword ptr fs:[00000030h] 7_2_014D47FB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D47FB mov eax, dword ptr fs:[00000030h] 7_2_014D47FB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157678E mov eax, dword ptr fs:[00000030h] 7_2_0157678E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D07AF mov eax, dword ptr fs:[00000030h] 7_2_014D07AF
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015847A0 mov eax, dword ptr fs:[00000030h] 7_2_015847A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EC640 mov eax, dword ptr fs:[00000030h] 7_2_014EC640
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01502674 mov eax, dword ptr fs:[00000030h] 7_2_01502674
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150A660 mov eax, dword ptr fs:[00000030h] 7_2_0150A660
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150A660 mov eax, dword ptr fs:[00000030h] 7_2_0150A660
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159866E mov eax, dword ptr fs:[00000030h] 7_2_0159866E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159866E mov eax, dword ptr fs:[00000030h] 7_2_0159866E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h] 7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h] 7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h] 7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h] 7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h] 7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h] 7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h] 7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01512619 mov eax, dword ptr fs:[00000030h] 7_2_01512619
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E609 mov eax, dword ptr fs:[00000030h] 7_2_0154E609
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D262C mov eax, dword ptr fs:[00000030h] 7_2_014D262C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014EE627 mov eax, dword ptr fs:[00000030h] 7_2_014EE627
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01506620 mov eax, dword ptr fs:[00000030h] 7_2_01506620
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01508620 mov eax, dword ptr fs:[00000030h] 7_2_01508620
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150A6C7 mov ebx, dword ptr fs:[00000030h] 7_2_0150A6C7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150A6C7 mov eax, dword ptr fs:[00000030h] 7_2_0150A6C7
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015506F1 mov eax, dword ptr fs:[00000030h] 7_2_015506F1
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015506F1 mov eax, dword ptr fs:[00000030h] 7_2_015506F1
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E6F2 mov eax, dword ptr fs:[00000030h] 7_2_0154E6F2
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E6F2 mov eax, dword ptr fs:[00000030h] 7_2_0154E6F2
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E6F2 mov eax, dword ptr fs:[00000030h] 7_2_0154E6F2
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E6F2 mov eax, dword ptr fs:[00000030h] 7_2_0154E6F2
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D4690 mov eax, dword ptr fs:[00000030h] 7_2_014D4690
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D4690 mov eax, dword ptr fs:[00000030h] 7_2_014D4690
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015066B0 mov eax, dword ptr fs:[00000030h] 7_2_015066B0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150C6A6 mov eax, dword ptr fs:[00000030h] 7_2_0150C6A6
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01550946 mov eax, dword ptr fs:[00000030h] 7_2_01550946
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A4940 mov eax, dword ptr fs:[00000030h] 7_2_015A4940
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155C97C mov eax, dword ptr fs:[00000030h] 7_2_0155C97C
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F6962 mov eax, dword ptr fs:[00000030h] 7_2_014F6962
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F6962 mov eax, dword ptr fs:[00000030h] 7_2_014F6962
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F6962 mov eax, dword ptr fs:[00000030h] 7_2_014F6962
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01574978 mov eax, dword ptr fs:[00000030h] 7_2_01574978
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01574978 mov eax, dword ptr fs:[00000030h] 7_2_01574978
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0151096E mov eax, dword ptr fs:[00000030h] 7_2_0151096E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0151096E mov edx, dword ptr fs:[00000030h] 7_2_0151096E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0151096E mov eax, dword ptr fs:[00000030h] 7_2_0151096E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155C912 mov eax, dword ptr fs:[00000030h] 7_2_0155C912
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014C8918 mov eax, dword ptr fs:[00000030h] 7_2_014C8918
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014C8918 mov eax, dword ptr fs:[00000030h] 7_2_014C8918
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E908 mov eax, dword ptr fs:[00000030h] 7_2_0154E908
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154E908 mov eax, dword ptr fs:[00000030h] 7_2_0154E908
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0156892B mov eax, dword ptr fs:[00000030h] 7_2_0156892B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155892A mov eax, dword ptr fs:[00000030h] 7_2_0155892A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015049D0 mov eax, dword ptr fs:[00000030h] 7_2_015049D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159A9D3 mov eax, dword ptr fs:[00000030h] 7_2_0159A9D3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015669C0 mov eax, dword ptr fs:[00000030h] 7_2_015669C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h] 7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h] 7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h] 7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h] 7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h] 7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h] 7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015029F9 mov eax, dword ptr fs:[00000030h] 7_2_015029F9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015029F9 mov eax, dword ptr fs:[00000030h] 7_2_015029F9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155E9E0 mov eax, dword ptr fs:[00000030h] 7_2_0155E9E0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D09AD mov eax, dword ptr fs:[00000030h] 7_2_014D09AD
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D09AD mov eax, dword ptr fs:[00000030h] 7_2_014D09AD
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015589B3 mov esi, dword ptr fs:[00000030h] 7_2_015589B3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015589B3 mov eax, dword ptr fs:[00000030h] 7_2_015589B3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015589B3 mov eax, dword ptr fs:[00000030h] 7_2_015589B3
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h] 7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01500854 mov eax, dword ptr fs:[00000030h] 7_2_01500854
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E2840 mov ecx, dword ptr fs:[00000030h] 7_2_014E2840
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D4859 mov eax, dword ptr fs:[00000030h] 7_2_014D4859
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D4859 mov eax, dword ptr fs:[00000030h] 7_2_014D4859
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01566870 mov eax, dword ptr fs:[00000030h] 7_2_01566870
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01566870 mov eax, dword ptr fs:[00000030h] 7_2_01566870
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155E872 mov eax, dword ptr fs:[00000030h] 7_2_0155E872
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155E872 mov eax, dword ptr fs:[00000030h] 7_2_0155E872
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155C810 mov eax, dword ptr fs:[00000030h] 7_2_0155C810
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150A830 mov eax, dword ptr fs:[00000030h] 7_2_0150A830
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157483A mov eax, dword ptr fs:[00000030h] 7_2_0157483A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157483A mov eax, dword ptr fs:[00000030h] 7_2_0157483A
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F2835 mov eax, dword ptr fs:[00000030h] 7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F2835 mov eax, dword ptr fs:[00000030h] 7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F2835 mov eax, dword ptr fs:[00000030h] 7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F2835 mov ecx, dword ptr fs:[00000030h] 7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F2835 mov eax, dword ptr fs:[00000030h] 7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F2835 mov eax, dword ptr fs:[00000030h] 7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FE8C0 mov eax, dword ptr fs:[00000030h] 7_2_014FE8C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A08C0 mov eax, dword ptr fs:[00000030h] 7_2_015A08C0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150C8F9 mov eax, dword ptr fs:[00000030h] 7_2_0150C8F9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150C8F9 mov eax, dword ptr fs:[00000030h] 7_2_0150C8F9
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159A8E4 mov eax, dword ptr fs:[00000030h] 7_2_0159A8E4
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155C89D mov eax, dword ptr fs:[00000030h] 7_2_0155C89D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D0887 mov eax, dword ptr fs:[00000030h] 7_2_014D0887
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157EB50 mov eax, dword ptr fs:[00000030h] 7_2_0157EB50
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A2B57 mov eax, dword ptr fs:[00000030h] 7_2_015A2B57
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A2B57 mov eax, dword ptr fs:[00000030h] 7_2_015A2B57
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A2B57 mov eax, dword ptr fs:[00000030h] 7_2_015A2B57
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A2B57 mov eax, dword ptr fs:[00000030h] 7_2_015A2B57
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01584B4B mov eax, dword ptr fs:[00000030h] 7_2_01584B4B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01584B4B mov eax, dword ptr fs:[00000030h] 7_2_01584B4B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01578B42 mov eax, dword ptr fs:[00000030h] 7_2_01578B42
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01566B40 mov eax, dword ptr fs:[00000030h] 7_2_01566B40
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01566B40 mov eax, dword ptr fs:[00000030h] 7_2_01566B40
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0159AB40 mov eax, dword ptr fs:[00000030h] 7_2_0159AB40
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014C8B50 mov eax, dword ptr fs:[00000030h] 7_2_014C8B50
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014CCB7E mov eax, dword ptr fs:[00000030h] 7_2_014CCB7E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h] 7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h] 7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h] 7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h] 7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h] 7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h] 7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h] 7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h] 7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h] 7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_015A4B00 mov eax, dword ptr fs:[00000030h] 7_2_015A4B00
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FEB20 mov eax, dword ptr fs:[00000030h] 7_2_014FEB20
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FEB20 mov eax, dword ptr fs:[00000030h] 7_2_014FEB20
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01598B28 mov eax, dword ptr fs:[00000030h] 7_2_01598B28
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01598B28 mov eax, dword ptr fs:[00000030h] 7_2_01598B28
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D0BCD mov eax, dword ptr fs:[00000030h] 7_2_014D0BCD
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D0BCD mov eax, dword ptr fs:[00000030h] 7_2_014D0BCD
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D0BCD mov eax, dword ptr fs:[00000030h] 7_2_014D0BCD
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F0BCB mov eax, dword ptr fs:[00000030h] 7_2_014F0BCB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F0BCB mov eax, dword ptr fs:[00000030h] 7_2_014F0BCB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F0BCB mov eax, dword ptr fs:[00000030h] 7_2_014F0BCB
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157EBD0 mov eax, dword ptr fs:[00000030h] 7_2_0157EBD0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155CBF0 mov eax, dword ptr fs:[00000030h] 7_2_0155CBF0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FEBFC mov eax, dword ptr fs:[00000030h] 7_2_014FEBFC
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D8BF0 mov eax, dword ptr fs:[00000030h] 7_2_014D8BF0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D8BF0 mov eax, dword ptr fs:[00000030h] 7_2_014D8BF0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D8BF0 mov eax, dword ptr fs:[00000030h] 7_2_014D8BF0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01584BB0 mov eax, dword ptr fs:[00000030h] 7_2_01584BB0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01584BB0 mov eax, dword ptr fs:[00000030h] 7_2_01584BB0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0BBE mov eax, dword ptr fs:[00000030h] 7_2_014E0BBE
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0BBE mov eax, dword ptr fs:[00000030h] 7_2_014E0BBE
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0A5B mov eax, dword ptr fs:[00000030h] 7_2_014E0A5B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014E0A5B mov eax, dword ptr fs:[00000030h] 7_2_014E0A5B
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h] 7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h] 7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h] 7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h] 7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h] 7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h] 7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h] 7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154CA72 mov eax, dword ptr fs:[00000030h] 7_2_0154CA72
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0154CA72 mov eax, dword ptr fs:[00000030h] 7_2_0154CA72
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0157EA60 mov eax, dword ptr fs:[00000030h] 7_2_0157EA60
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150CA6F mov eax, dword ptr fs:[00000030h] 7_2_0150CA6F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150CA6F mov eax, dword ptr fs:[00000030h] 7_2_0150CA6F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150CA6F mov eax, dword ptr fs:[00000030h] 7_2_0150CA6F
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0155CA11 mov eax, dword ptr fs:[00000030h] 7_2_0155CA11
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014FEA2E mov eax, dword ptr fs:[00000030h] 7_2_014FEA2E
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150CA38 mov eax, dword ptr fs:[00000030h] 7_2_0150CA38
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150CA24 mov eax, dword ptr fs:[00000030h] 7_2_0150CA24
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F4A35 mov eax, dword ptr fs:[00000030h] 7_2_014F4A35
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014F4A35 mov eax, dword ptr fs:[00000030h] 7_2_014F4A35
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01504AD0 mov eax, dword ptr fs:[00000030h] 7_2_01504AD0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01504AD0 mov eax, dword ptr fs:[00000030h] 7_2_01504AD0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014D0AD0 mov eax, dword ptr fs:[00000030h] 7_2_014D0AD0
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01526ACC mov eax, dword ptr fs:[00000030h] 7_2_01526ACC
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01526ACC mov eax, dword ptr fs:[00000030h] 7_2_01526ACC
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01526ACC mov eax, dword ptr fs:[00000030h] 7_2_01526ACC
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150AAEE mov eax, dword ptr fs:[00000030h] 7_2_0150AAEE
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_0150AAEE mov eax, dword ptr fs:[00000030h] 7_2_0150AAEE
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_01508A90 mov edx, dword ptr fs:[00000030h] 7_2_01508A90
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DEA80 mov eax, dword ptr fs:[00000030h] 7_2_014DEA80
Source: C:\Users\user\Desktop\Quote35664776.exe Code function: 7_2_014DEA80 mov eax, dword ptr fs:[00000030h] 7_2_014DEA80
Enables debug privileges
Source: C:\Users\user\Desktop\Quote35664776.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Quote35664776.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote35664776.exe"
Source: C:\Users\user\Desktop\Quote35664776.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote35664776.exe" Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Quote35664776.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote35664776.exe" Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Process created: C:\Users\user\Desktop\Quote35664776.exe "C:\Users\user\Desktop\Quote35664776.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Quote35664776.exe Queries volume information: C:\Users\user\Desktop\Quote35664776.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1543824 Sample: Quote35664776.exe Startdate: 28/10/2024 Architecture: WINDOWS Score: 100 22 Malicious sample detected (through community Yara rule) 2->22 24 Antivirus / Scanner detection for submitted sample 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 6 other signatures 2->28 7 Quote35664776.exe 4 2->7         started        process3 file4 20 C:\Users\user\...\Quote35664776.exe.log, ASCII 7->20 dropped 30 Adds a directory exclusion to Windows Defender 7->30 11 powershell.exe 23 7->11         started        14 Quote35664776.exe 7->14         started        signatures5 process6 signatures7 32 Loading BitLocker PowerShell Module 11->32 16 conhost.exe 11->16         started        18 WmiPrvSE.exe 11->18         started        process8
⊘No contacted IP infos