Windows Analysis Report
Quote35664776.exe

AI detected suspicious sample

Source: Yara match	File source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Quote35664776.exe

Joe Sandbox ML: detected

Source: Quote35664776.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Quote35664776.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: Quote35664776.exe, 00000007.00000002.1359717433.00000000014A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Quote35664776.exe, Quote35664776.exe, 00000007.00000002.1359717433.00000000014A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: yjvR.pdb source: Quote35664776.exe
Source:	Binary string: yjvR.pdbSHA256 source: Quote35664776.exe

Source: Quote35664776.exe, 00000003.00000002.1331118649.0000000002D2D000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0042C4E3 NtClose,	7_2_0042C4E3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512B60 NtClose,LdrInitializeThunk,	7_2_01512B60
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512DF0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_01512DF0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512C70 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_01512C70
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015135C0 NtCreateMutant,LdrInitializeThunk,	7_2_015135C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01514340 NtSetContextThread,	7_2_01514340
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01514650 NtSuspendThread,	7_2_01514650
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512BF0 NtAllocateVirtualMemory,	7_2_01512BF0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512BE0 NtQueryValueKey,	7_2_01512BE0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512B80 NtQueryInformationFile,	7_2_01512B80
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512BA0 NtEnumerateValueKey,	7_2_01512BA0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512AD0 NtReadFile,	7_2_01512AD0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512AF0 NtWriteFile,	7_2_01512AF0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512AB0 NtWaitForSingleObject,	7_2_01512AB0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512D10 NtMapViewOfSection,	7_2_01512D10
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512D00 NtSetInformationFile,	7_2_01512D00
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512D30 NtUnmapViewOfSection,	7_2_01512D30
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512DD0 NtDelayExecution,	7_2_01512DD0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512DB0 NtEnumerateKey,	7_2_01512DB0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512C60 NtCreateKey,	7_2_01512C60
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512C00 NtQueryInformationProcess,	7_2_01512C00
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512CC0 NtQueryVirtualMemory,	7_2_01512CC0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512CF0 NtOpenProcess,	7_2_01512CF0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512CA0 NtQueryInformationToken,	7_2_01512CA0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512F60 NtCreateProcessEx,	7_2_01512F60
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512F30 NtCreateSection,	7_2_01512F30
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512FE0 NtCreateFile,	7_2_01512FE0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512F90 NtProtectVirtualMemory,	7_2_01512F90
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512FB0 NtResumeThread,	7_2_01512FB0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512FA0 NtQuerySection,	7_2_01512FA0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512E30 NtWriteVirtualMemory,	7_2_01512E30
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512EE0 NtQueueApcThread,	7_2_01512EE0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512E80 NtReadVirtualMemory,	7_2_01512E80
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512EA0 NtAdjustPrivilegesToken,	7_2_01512EA0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01513010 NtOpenDirectoryObject,	7_2_01513010
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01513090 NtSetValueKey,	7_2_01513090
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015139B0 NtGetContextThread,	7_2_015139B0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01513D70 NtOpenThread,	7_2_01513D70
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01513D10 NtOpenProcessToken,	7_2_01513D10

Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 3_2_010CDA8C	3_2_010CDA8C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 3_2_0CC53A10	3_2_0CC53A10
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0040284A	7_2_0040284A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_00402850	7_2_00402850
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_00410093	7_2_00410093
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_00403150	7_2_00403150
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0040E113	7_2_0040E113
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0042EB03	7_2_0042EB03
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0040FE6E	7_2_0040FE6E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0040FE73	7_2_0040FE73
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_00416733	7_2_00416733
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01568158	7_2_01568158
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D0100	7_2_014D0100
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157A118	7_2_0157A118
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015981CC	7_2_015981CC
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A01AA	7_2_015A01AA
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015941A2	7_2_015941A2
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01572000	7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159A352	7_2_0159A352
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A03E6	7_2_015A03E6
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EE3F0	7_2_014EE3F0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015602C0	7_2_015602C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0535	7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A0591	7_2_015A0591
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01592446	7_2_01592446
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01584420	7_2_01584420
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0158E4F6	7_2_0158E4F6
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01504750	7_2_01504750
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DC7C0	7_2_014DC7C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FC6E0	7_2_014FC6E0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F6962	7_2_014F6962
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015AA9A6	7_2_015AA9A6
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E2840	7_2_014E2840
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EA840	7_2_014EA840
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E8F0	7_2_0150E8F0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014C68B8	7_2_014C68B8
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159AB40	7_2_0159AB40
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01596BD7	7_2_01596BD7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DEA80	7_2_014DEA80
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157CD1F	7_2_0157CD1F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EAD00	7_2_014EAD00
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DADE0	7_2_014DADE0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F8DBF	7_2_014F8DBF
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0C00	7_2_014E0C00
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D0CF2	7_2_014D0CF2
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580CB5	7_2_01580CB5
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01554F40	7_2_01554F40
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01500F30	7_2_01500F30
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01582F30	7_2_01582F30
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01522F28	7_2_01522F28
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D2FC8	7_2_014D2FC8
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014ECFE0	7_2_014ECFE0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155EFA0	7_2_0155EFA0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0E59	7_2_014E0E59
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159EE26	7_2_0159EE26
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159EEDB	7_2_0159EEDB
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159CE93	7_2_0159CE93
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F2E90	7_2_014F2E90
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015AB16B	7_2_015AB16B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0151516C	7_2_0151516C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CF172	7_2_014CF172
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EB1B0	7_2_014EB1B0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E70C0	7_2_014E70C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0158F0CC	7_2_0158F0CC
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015970E9	7_2_015970E9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159F0E0	7_2_0159F0E0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CD34C	7_2_014CD34C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159132D	7_2_0159132D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0152739A	7_2_0152739A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FB2C0	7_2_014FB2C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015812ED	7_2_015812ED
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E52A0	7_2_014E52A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01597571	7_2_01597571
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A95C3	7_2_015A95C3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157D5B0	7_2_0157D5B0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D1460	7_2_014D1460
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159F43F	7_2_0159F43F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159F7B0	7_2_0159F7B0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01525630	7_2_01525630
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015916CC	7_2_015916CC
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E9950	7_2_014E9950
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FB950	7_2_014FB950
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01575910	7_2_01575910
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154D800	7_2_0154D800
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E38E0	7_2_014E38E0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159FB76	7_2_0159FB76
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01555BF0	7_2_01555BF0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0151DBF9	7_2_0151DBF9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FFB80	7_2_014FFB80
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159FA49	7_2_0159FA49
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01597A46	7_2_01597A46
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01553A6C	7_2_01553A6C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0158DAC6	7_2_0158DAC6
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01525AA0	7_2_01525AA0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157DAAC	7_2_0157DAAC
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01581AA3	7_2_01581AA3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01591D5A	7_2_01591D5A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E3D40	7_2_014E3D40
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01597D73	7_2_01597D73
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FFDC0	7_2_014FFDC0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01559C32	7_2_01559C32
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159FCF2	7_2_0159FCF2
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159FF09	7_2_0159FF09
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014A3FD2	7_2_014A3FD2
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014A3FD5	7_2_014A3FD5
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E1F92	7_2_014E1F92
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159FFB1	7_2_0159FFB1
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E9EB0	7_2_014E9EB0

Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: String function: 01515130 appears 58 times
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: String function: 0155F290 appears 105 times
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: String function: 014CB970 appears 277 times
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: String function: 0154EA12 appears 86 times
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: String function: 01527E54 appears 111 times

Source: Quote35664776.exe, 00000003.00000002.1339818113.0000000009BC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Quote35664776.exe
Source: Quote35664776.exe, 00000003.00000002.1306406310.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Quote35664776.exe
Source: Quote35664776.exe, 00000003.00000000.1280871170.0000000000736000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameyjvR.exe6 vs Quote35664776.exe
Source: Quote35664776.exe, 00000007.00000002.1359717433.00000000015CD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Quote35664776.exe
Source: Quote35664776.exe	Binary or memory string: OriginalFilenameyjvR.exe6 vs Quote35664776.exe

Source: Quote35664776.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: Quote35664776.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, x6cK73VO5rSrjlo76X.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Sok1NDXnWLr75Px8nU.cs	Security API names: _0020.SetAccessControl
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Sok1NDXnWLr75Px8nU.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Sok1NDXnWLr75Px8nU.cs	Security API names: _0020.AddAccessRule
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Sok1NDXnWLr75Px8nU.cs	Security API names: _0020.SetAccessControl
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Sok1NDXnWLr75Px8nU.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Sok1NDXnWLr75Px8nU.cs	Security API names: _0020.AddAccessRule
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, x6cK73VO5rSrjlo76X.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, x6cK73VO5rSrjlo76X.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Sok1NDXnWLr75Px8nU.cs	Security API names: _0020.SetAccessControl
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Sok1NDXnWLr75Px8nU.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Sok1NDXnWLr75Px8nU.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/6@0/0

Source: C:\Users\user\Desktop\Quote35664776.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quote35664776.exe.log

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7308:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_auxzxpwz.0ck.ps1

Source: Quote35664776.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Quote35664776.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Quote35664776.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Quote35664776.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Quote35664776.exe

ReversingLabs: Detection: 42%

Source: Quote35664776.exe

String found in binary or memory: $8ef8c825-4d3b-4232-add3-f59032e3b409

Source: unknown	Process created: C:\Users\user\Desktop\Quote35664776.exe "C:\Users\user\Desktop\Quote35664776.exe"
Source: C:\Users\user\Desktop\Quote35664776.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote35664776.exe"
Source: C:\Users\user\Desktop\Quote35664776.exe	Process created: C:\Users\user\Desktop\Quote35664776.exe "C:\Users\user\Desktop\Quote35664776.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\Quote35664776.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote35664776.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process created: C:\Users\user\Desktop\Quote35664776.exe "C:\Users\user\Desktop\Quote35664776.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Quote35664776.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Quote35664776.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: Quote35664776.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Quote35664776.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Quote35664776.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Quote35664776.exe, 00000007.00000002.1359717433.00000000014A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Quote35664776.exe, Quote35664776.exe, 00000007.00000002.1359717433.00000000014A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: yjvR.pdb source: Quote35664776.exe
Source:	Binary string: yjvR.pdbSHA256 source: Quote35664776.exe

Data Obfuscation

Source: Quote35664776.exe, frmMain.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: Quote35664776.exe, frmMain.cs	.Net Code: InitializeComponent
Source: 3.2.Quote35664776.exe.3ac0b90.0.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Sok1NDXnWLr75Px8nU.cs	.Net Code: Qy11SmBiIl System.Reflection.Assembly.Load(byte[])
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Sok1NDXnWLr75Px8nU.cs	.Net Code: Qy11SmBiIl System.Reflection.Assembly.Load(byte[])
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Sok1NDXnWLr75Px8nU.cs	.Net Code: Qy11SmBiIl System.Reflection.Assembly.Load(byte[])
Source: 3.2.Quote35664776.exe.5270000.3.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])

Source: Quote35664776.exe

Static PE information: 0x89636CF8 [Fri Jan 16 04:15:52 2043 UTC]

Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0041F0D1 push ebp; iretd	7_2_0041F0DA
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_004118F3 push esp; iretd	7_2_00411926
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_004118B0 push esp; iretd	7_2_00411926
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0041B2EA pushfd ; retf	7_2_0041B2ED
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_004033D0 push eax; ret	7_2_004033D2
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0040BCC7 push C1009F53h; ret	7_2_0040BCCE
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_00406567 push edx; iretd	7_2_00406568
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_004165BD pushfd ; retf	7_2_004165C1
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0040863B push ebx; iretd	7_2_0040863C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0041E74B push ds; iretd	7_2_0041E74C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014A225F pushad ; ret	7_2_014A27F9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014A27FA pushad ; ret	7_2_014A27F9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D09AD push ecx; mov dword ptr [esp], ecx	7_2_014D09B6
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014A283D push eax; iretd	7_2_014A2858
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014A135E push eax; iretd	7_2_014A1369

Source: Quote35664776.exe

Static PE information: section name: .text entropy: 7.977991168390122

Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, x6cK73VO5rSrjlo76X.cs	High entropy of concatenated method names: 'TQsPny76uP', 'SbePZE6Mfh', 'jOXPuGTfHo', 'B5YPawatgb', 'WOrPLv2iHX', 'uJwPhopWer', 'oKFPwC6E9i', 'j2qP3CIG7J', 'hUSP6JvV92', 'd0jPEbrVmV'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, rFLhHkFC8SefOnqKOq2.cs	High entropy of concatenated method names: 'm7GINcdEq5', 'HmpIFKDHCE', 'F4JISsZ4Le', 'PBYIbZHiqX', 'pGDIgbTvxR', 'vXsIeB42gm', 'U8dI0JgbIZ', 'O6oIYSIv5o', 'PStIAhM343', 'E3kIvFFOD9'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Sok1NDXnWLr75Px8nU.cs	High entropy of concatenated method names: 'Nww7sb97WO', 'IqA7rRAUn6', 'RTr7P81epm', 'RsQ7cNkkIb', 'A6N7G8gVib', 'vyj7xSE4Ot', 'SKu7iOcdCI', 'H3m7Vet7HY', 'cWO7pIkvnI', 'IhF75bdBEb'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, HZ68fDib74Ymn7KC6t.cs	High entropy of concatenated method names: 'tLqIXJhXfm', 'LkHI7XTrsi', 'HQ5I1a1loi', 'k7MIrdgF88', 'L3LIPOpIVP', 'siqIGbiIxf', 'Io9IxpXOFc', 'WSWUwsnrTa', 'BedU3a4L1c', 'M18U6yFKq7'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, bs2fgozyYvXB1H4niC.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QwHIBmFJs9', 'QSTIkuJ6og', 'gicIykCkQX', 'xGMIDdc9da', 'UqTIUvjvl4', 'gBYIIYJr5J', 'WgiIOUWPtx'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, bA9RTfZIChuDRqfLHK.cs	High entropy of concatenated method names: 'TsCxsnGHwO', 'OTcxP6ioLA', 'WCuxGYAqCa', 'QHIxiwRj6P', 'DUqxVpMfbf', 'hAEGLN45hs', 'xkPGhWvnqp', 'cFLGwWTMOn', 'mCmG3o6kjn', 'YdeG6DvAqT'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, vAn0HoArA23Maefiap.cs	High entropy of concatenated method names: 'BEtcbdZ8BK', 'mBxceDM8GV', 'rvccYniltf', 'PKucA0Hneh', 'IdQcke2hU3', 'iuncyssD0S', 't6lcDhlKvB', 'IxYcUI3Meq', 'tpMcIbrMft', 'QracOxAaOg'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, SW8DeeB6aVHGjqOFRf.cs	High entropy of concatenated method names: 'smVUrYns7P', 'esLUPjmHUp', 'osfUcvjLvM', 'oHTUGrxCY4', 'Y2XUxqM7Bh', 'xEuUiS06XZ', 'eXyUVRqitd', 'MvfUpetVpR', 'pG5U5Uu3AB', 'k6HUo1ruHH'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, LrDp2gPDDKXhK6nGRi.cs	High entropy of concatenated method names: 'BfFBYAM7ks', 'APTBAFO9pD', 'qtbBTB0oOK', 'd6NBdMnkb9', 'C0dBfHLt9e', 'r5lBHpy8dj', 'TMmB9k7q8c', 'rDrBJmX3RA', 'yZSBRKCB3D', 'Bh1B8EiMdw'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, pINXIehvWXwyqsnbgr.cs	High entropy of concatenated method names: 'j0eXiGkS4B', 'WE5XVX4qFr', 'iVmX578VTs', 'VYgXofu2ZN', 'm64XkeuXTx', 'fTHXyNcQ1u', 'WURla1957MyhsF3ELX', 'euhib6kbWrXOlCseQd', 'p9GXXjqfrU', 'u0nX7AtSqw'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, bAfoyn70OPLcRmMWLY.cs	High entropy of concatenated method names: 'XiLUTV9Q7D', 'I9IUdGnRrB', 'riEUWrvEyN', 'vjTUfEUjo1', 'dCOUnFR6hV', 'QmfUHbl9Ts', 'Next', 'Next', 'Next', 'NextBytes'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, A6o9CQUC8uU9J0HUNg.cs	High entropy of concatenated method names: 'X4GirPfnY9', 'mvDicx1sBU', 'MERix8dQWZ', 'o1gxERdKxr', 'zKIxzeKlcw', 'mkfiQaFUjC', 'DhxiXr1oXg', 'rJhiC1Nw3T', 'tZoi7GC7Zh', 'uMsi1l8pmq'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Q52MZZGMumw2JdOafM.cs	High entropy of concatenated method names: 'l2UD3EJiRk', 'swCDEOfvFm', 'MU7UQD2lG3', 'oj7UXPKs4T', 'lSiD8kY3WS', 'XY4DK7N7YQ', 'B7nDjCXbcp', 'Ul6DnV5EdX', 'qpDDZHQA9L', 'MujDuJtGJY'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, YPyR0rScyFQHt4LSxI.cs	High entropy of concatenated method names: 'IF7SOoKod', 'VxIbiYaZ3', 'bSFe3XdW6', 'a7i0xcD7o', 'OSAADwIuL', 'zJkv5Y2yA', 'yoHpMMT5JH0jEHZcuE', 'vnC6nAJA6jemhhOKx6', 'q0YUL4s7G', 'ipSO6UrwS'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, VPTB9Hj1KQYmwFwebe.cs	High entropy of concatenated method names: 'zbCxuQglUr', 'kYuxa7IBa8', 'RIoxL4uDRY', 'ToString', 'tKVxhl70Ti', 'P5dxwuKL2A', 'bdVNOCeCcMocE4bpyn5', 'oN01BCe05Bl6IXl1nfB', 'l5XgpSe54nY59H2KsBi', 'tOVTOQe1SsWQ8HlWL4V'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, auGahYmrbOXQpKrlGf.cs	High entropy of concatenated method names: 'q5wkRYNSlj', 'CJkkK0g6In', 'Wu1kn607Wt', 'JqhkZj4gN1', 'oN2kdKUevq', 'nHbkWCC6Rh', 'I4Ukf1XC2h', 'sfnkHh6gbw', 'ck4k4U6gGO', 'r1qk9yrPPp'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, syv7QdNKtKblnuuuxd.cs	High entropy of concatenated method names: 'n6JGgvBfBc', 'WyeG0jS8VD', 'toncWaaqaK', 'ryAcf7Tv6W', 'EJQcH9DjBF', 'jONc4schkH', 'g1Dc90c0iV', 'Dt2cJnitZx', 'Mx7cmivFXr', 'gjKcRWLAh4'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, SbBo3aTf4cNGFXq9s0.cs	High entropy of concatenated method names: 'cy0iNyYDXo', 'wsiiFxWRwt', 'DyTiSQtMO3', 's4xibu9GTp', 'MumigNNe82', 'E8Die6JJ0T', 'Sf4i0KijoF', 'aeLiY01KNP', 'w92iA8FhrJ', 'KDlivZS8Eh'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, u2YxUHxItJFpKQdbGU.cs	High entropy of concatenated method names: 'ToString', 'ejjy86Wpgx', 'dumydcR8nU', 'EjbyWFgZEe', 'z0Vyfmw7oU', 'vmbyHvjoGV', 'hD9y4BaQQF', 'lRny9yuOHw', 'nIhyJV3ASg', 'FvJymXBY1G'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, R8F35CDOHwNew9N6HY.cs	High entropy of concatenated method names: 'Dispose', 'bLhX6xDWY1', 'HhNCdHkkuR', 'QkJqq8Tk0q', 'WwLXEaG89i', 'bRNXzsb5yg', 'ProcessDialogKey', 'C3RCQRqA7L', 'TkHCXaPEYI', 'NQYCCkRIvR'
Source: 3.2.Quote35664776.exe.9bc0000.4.raw.unpack, Omg99GFnvJiuifGl2TV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RL6OnckV1V', 'I3qOZooGr0', 'IUZOuRFDZR', 'qC5OaVVAKs', 'UMDOLS2ElB', 'z6FOhPgT43', 'LnROwXhZcl'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, x6cK73VO5rSrjlo76X.cs	High entropy of concatenated method names: 'TQsPny76uP', 'SbePZE6Mfh', 'jOXPuGTfHo', 'B5YPawatgb', 'WOrPLv2iHX', 'uJwPhopWer', 'oKFPwC6E9i', 'j2qP3CIG7J', 'hUSP6JvV92', 'd0jPEbrVmV'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, rFLhHkFC8SefOnqKOq2.cs	High entropy of concatenated method names: 'm7GINcdEq5', 'HmpIFKDHCE', 'F4JISsZ4Le', 'PBYIbZHiqX', 'pGDIgbTvxR', 'vXsIeB42gm', 'U8dI0JgbIZ', 'O6oIYSIv5o', 'PStIAhM343', 'E3kIvFFOD9'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Sok1NDXnWLr75Px8nU.cs	High entropy of concatenated method names: 'Nww7sb97WO', 'IqA7rRAUn6', 'RTr7P81epm', 'RsQ7cNkkIb', 'A6N7G8gVib', 'vyj7xSE4Ot', 'SKu7iOcdCI', 'H3m7Vet7HY', 'cWO7pIkvnI', 'IhF75bdBEb'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, HZ68fDib74Ymn7KC6t.cs	High entropy of concatenated method names: 'tLqIXJhXfm', 'LkHI7XTrsi', 'HQ5I1a1loi', 'k7MIrdgF88', 'L3LIPOpIVP', 'siqIGbiIxf', 'Io9IxpXOFc', 'WSWUwsnrTa', 'BedU3a4L1c', 'M18U6yFKq7'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, bs2fgozyYvXB1H4niC.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QwHIBmFJs9', 'QSTIkuJ6og', 'gicIykCkQX', 'xGMIDdc9da', 'UqTIUvjvl4', 'gBYIIYJr5J', 'WgiIOUWPtx'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, bA9RTfZIChuDRqfLHK.cs	High entropy of concatenated method names: 'TsCxsnGHwO', 'OTcxP6ioLA', 'WCuxGYAqCa', 'QHIxiwRj6P', 'DUqxVpMfbf', 'hAEGLN45hs', 'xkPGhWvnqp', 'cFLGwWTMOn', 'mCmG3o6kjn', 'YdeG6DvAqT'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, vAn0HoArA23Maefiap.cs	High entropy of concatenated method names: 'BEtcbdZ8BK', 'mBxceDM8GV', 'rvccYniltf', 'PKucA0Hneh', 'IdQcke2hU3', 'iuncyssD0S', 't6lcDhlKvB', 'IxYcUI3Meq', 'tpMcIbrMft', 'QracOxAaOg'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, SW8DeeB6aVHGjqOFRf.cs	High entropy of concatenated method names: 'smVUrYns7P', 'esLUPjmHUp', 'osfUcvjLvM', 'oHTUGrxCY4', 'Y2XUxqM7Bh', 'xEuUiS06XZ', 'eXyUVRqitd', 'MvfUpetVpR', 'pG5U5Uu3AB', 'k6HUo1ruHH'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, LrDp2gPDDKXhK6nGRi.cs	High entropy of concatenated method names: 'BfFBYAM7ks', 'APTBAFO9pD', 'qtbBTB0oOK', 'd6NBdMnkb9', 'C0dBfHLt9e', 'r5lBHpy8dj', 'TMmB9k7q8c', 'rDrBJmX3RA', 'yZSBRKCB3D', 'Bh1B8EiMdw'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, pINXIehvWXwyqsnbgr.cs	High entropy of concatenated method names: 'j0eXiGkS4B', 'WE5XVX4qFr', 'iVmX578VTs', 'VYgXofu2ZN', 'm64XkeuXTx', 'fTHXyNcQ1u', 'WURla1957MyhsF3ELX', 'euhib6kbWrXOlCseQd', 'p9GXXjqfrU', 'u0nX7AtSqw'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, bAfoyn70OPLcRmMWLY.cs	High entropy of concatenated method names: 'XiLUTV9Q7D', 'I9IUdGnRrB', 'riEUWrvEyN', 'vjTUfEUjo1', 'dCOUnFR6hV', 'QmfUHbl9Ts', 'Next', 'Next', 'Next', 'NextBytes'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, A6o9CQUC8uU9J0HUNg.cs	High entropy of concatenated method names: 'X4GirPfnY9', 'mvDicx1sBU', 'MERix8dQWZ', 'o1gxERdKxr', 'zKIxzeKlcw', 'mkfiQaFUjC', 'DhxiXr1oXg', 'rJhiC1Nw3T', 'tZoi7GC7Zh', 'uMsi1l8pmq'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Q52MZZGMumw2JdOafM.cs	High entropy of concatenated method names: 'l2UD3EJiRk', 'swCDEOfvFm', 'MU7UQD2lG3', 'oj7UXPKs4T', 'lSiD8kY3WS', 'XY4DK7N7YQ', 'B7nDjCXbcp', 'Ul6DnV5EdX', 'qpDDZHQA9L', 'MujDuJtGJY'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, YPyR0rScyFQHt4LSxI.cs	High entropy of concatenated method names: 'IF7SOoKod', 'VxIbiYaZ3', 'bSFe3XdW6', 'a7i0xcD7o', 'OSAADwIuL', 'zJkv5Y2yA', 'yoHpMMT5JH0jEHZcuE', 'vnC6nAJA6jemhhOKx6', 'q0YUL4s7G', 'ipSO6UrwS'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, VPTB9Hj1KQYmwFwebe.cs	High entropy of concatenated method names: 'zbCxuQglUr', 'kYuxa7IBa8', 'RIoxL4uDRY', 'ToString', 'tKVxhl70Ti', 'P5dxwuKL2A', 'bdVNOCeCcMocE4bpyn5', 'oN01BCe05Bl6IXl1nfB', 'l5XgpSe54nY59H2KsBi', 'tOVTOQe1SsWQ8HlWL4V'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, auGahYmrbOXQpKrlGf.cs	High entropy of concatenated method names: 'q5wkRYNSlj', 'CJkkK0g6In', 'Wu1kn607Wt', 'JqhkZj4gN1', 'oN2kdKUevq', 'nHbkWCC6Rh', 'I4Ukf1XC2h', 'sfnkHh6gbw', 'ck4k4U6gGO', 'r1qk9yrPPp'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, syv7QdNKtKblnuuuxd.cs	High entropy of concatenated method names: 'n6JGgvBfBc', 'WyeG0jS8VD', 'toncWaaqaK', 'ryAcf7Tv6W', 'EJQcH9DjBF', 'jONc4schkH', 'g1Dc90c0iV', 'Dt2cJnitZx', 'Mx7cmivFXr', 'gjKcRWLAh4'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, SbBo3aTf4cNGFXq9s0.cs	High entropy of concatenated method names: 'cy0iNyYDXo', 'wsiiFxWRwt', 'DyTiSQtMO3', 's4xibu9GTp', 'MumigNNe82', 'E8Die6JJ0T', 'Sf4i0KijoF', 'aeLiY01KNP', 'w92iA8FhrJ', 'KDlivZS8Eh'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, u2YxUHxItJFpKQdbGU.cs	High entropy of concatenated method names: 'ToString', 'ejjy86Wpgx', 'dumydcR8nU', 'EjbyWFgZEe', 'z0Vyfmw7oU', 'vmbyHvjoGV', 'hD9y4BaQQF', 'lRny9yuOHw', 'nIhyJV3ASg', 'FvJymXBY1G'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, R8F35CDOHwNew9N6HY.cs	High entropy of concatenated method names: 'Dispose', 'bLhX6xDWY1', 'HhNCdHkkuR', 'QkJqq8Tk0q', 'WwLXEaG89i', 'bRNXzsb5yg', 'ProcessDialogKey', 'C3RCQRqA7L', 'TkHCXaPEYI', 'NQYCCkRIvR'
Source: 3.2.Quote35664776.exe.45f82d8.1.raw.unpack, Omg99GFnvJiuifGl2TV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RL6OnckV1V', 'I3qOZooGr0', 'IUZOuRFDZR', 'qC5OaVVAKs', 'UMDOLS2ElB', 'z6FOhPgT43', 'LnROwXhZcl'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, x6cK73VO5rSrjlo76X.cs	High entropy of concatenated method names: 'TQsPny76uP', 'SbePZE6Mfh', 'jOXPuGTfHo', 'B5YPawatgb', 'WOrPLv2iHX', 'uJwPhopWer', 'oKFPwC6E9i', 'j2qP3CIG7J', 'hUSP6JvV92', 'd0jPEbrVmV'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, rFLhHkFC8SefOnqKOq2.cs	High entropy of concatenated method names: 'm7GINcdEq5', 'HmpIFKDHCE', 'F4JISsZ4Le', 'PBYIbZHiqX', 'pGDIgbTvxR', 'vXsIeB42gm', 'U8dI0JgbIZ', 'O6oIYSIv5o', 'PStIAhM343', 'E3kIvFFOD9'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Sok1NDXnWLr75Px8nU.cs	High entropy of concatenated method names: 'Nww7sb97WO', 'IqA7rRAUn6', 'RTr7P81epm', 'RsQ7cNkkIb', 'A6N7G8gVib', 'vyj7xSE4Ot', 'SKu7iOcdCI', 'H3m7Vet7HY', 'cWO7pIkvnI', 'IhF75bdBEb'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, HZ68fDib74Ymn7KC6t.cs	High entropy of concatenated method names: 'tLqIXJhXfm', 'LkHI7XTrsi', 'HQ5I1a1loi', 'k7MIrdgF88', 'L3LIPOpIVP', 'siqIGbiIxf', 'Io9IxpXOFc', 'WSWUwsnrTa', 'BedU3a4L1c', 'M18U6yFKq7'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, bs2fgozyYvXB1H4niC.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QwHIBmFJs9', 'QSTIkuJ6og', 'gicIykCkQX', 'xGMIDdc9da', 'UqTIUvjvl4', 'gBYIIYJr5J', 'WgiIOUWPtx'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, bA9RTfZIChuDRqfLHK.cs	High entropy of concatenated method names: 'TsCxsnGHwO', 'OTcxP6ioLA', 'WCuxGYAqCa', 'QHIxiwRj6P', 'DUqxVpMfbf', 'hAEGLN45hs', 'xkPGhWvnqp', 'cFLGwWTMOn', 'mCmG3o6kjn', 'YdeG6DvAqT'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, vAn0HoArA23Maefiap.cs	High entropy of concatenated method names: 'BEtcbdZ8BK', 'mBxceDM8GV', 'rvccYniltf', 'PKucA0Hneh', 'IdQcke2hU3', 'iuncyssD0S', 't6lcDhlKvB', 'IxYcUI3Meq', 'tpMcIbrMft', 'QracOxAaOg'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, SW8DeeB6aVHGjqOFRf.cs	High entropy of concatenated method names: 'smVUrYns7P', 'esLUPjmHUp', 'osfUcvjLvM', 'oHTUGrxCY4', 'Y2XUxqM7Bh', 'xEuUiS06XZ', 'eXyUVRqitd', 'MvfUpetVpR', 'pG5U5Uu3AB', 'k6HUo1ruHH'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, LrDp2gPDDKXhK6nGRi.cs	High entropy of concatenated method names: 'BfFBYAM7ks', 'APTBAFO9pD', 'qtbBTB0oOK', 'd6NBdMnkb9', 'C0dBfHLt9e', 'r5lBHpy8dj', 'TMmB9k7q8c', 'rDrBJmX3RA', 'yZSBRKCB3D', 'Bh1B8EiMdw'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, pINXIehvWXwyqsnbgr.cs	High entropy of concatenated method names: 'j0eXiGkS4B', 'WE5XVX4qFr', 'iVmX578VTs', 'VYgXofu2ZN', 'm64XkeuXTx', 'fTHXyNcQ1u', 'WURla1957MyhsF3ELX', 'euhib6kbWrXOlCseQd', 'p9GXXjqfrU', 'u0nX7AtSqw'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, bAfoyn70OPLcRmMWLY.cs	High entropy of concatenated method names: 'XiLUTV9Q7D', 'I9IUdGnRrB', 'riEUWrvEyN', 'vjTUfEUjo1', 'dCOUnFR6hV', 'QmfUHbl9Ts', 'Next', 'Next', 'Next', 'NextBytes'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, A6o9CQUC8uU9J0HUNg.cs	High entropy of concatenated method names: 'X4GirPfnY9', 'mvDicx1sBU', 'MERix8dQWZ', 'o1gxERdKxr', 'zKIxzeKlcw', 'mkfiQaFUjC', 'DhxiXr1oXg', 'rJhiC1Nw3T', 'tZoi7GC7Zh', 'uMsi1l8pmq'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Q52MZZGMumw2JdOafM.cs	High entropy of concatenated method names: 'l2UD3EJiRk', 'swCDEOfvFm', 'MU7UQD2lG3', 'oj7UXPKs4T', 'lSiD8kY3WS', 'XY4DK7N7YQ', 'B7nDjCXbcp', 'Ul6DnV5EdX', 'qpDDZHQA9L', 'MujDuJtGJY'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, YPyR0rScyFQHt4LSxI.cs	High entropy of concatenated method names: 'IF7SOoKod', 'VxIbiYaZ3', 'bSFe3XdW6', 'a7i0xcD7o', 'OSAADwIuL', 'zJkv5Y2yA', 'yoHpMMT5JH0jEHZcuE', 'vnC6nAJA6jemhhOKx6', 'q0YUL4s7G', 'ipSO6UrwS'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, VPTB9Hj1KQYmwFwebe.cs	High entropy of concatenated method names: 'zbCxuQglUr', 'kYuxa7IBa8', 'RIoxL4uDRY', 'ToString', 'tKVxhl70Ti', 'P5dxwuKL2A', 'bdVNOCeCcMocE4bpyn5', 'oN01BCe05Bl6IXl1nfB', 'l5XgpSe54nY59H2KsBi', 'tOVTOQe1SsWQ8HlWL4V'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, auGahYmrbOXQpKrlGf.cs	High entropy of concatenated method names: 'q5wkRYNSlj', 'CJkkK0g6In', 'Wu1kn607Wt', 'JqhkZj4gN1', 'oN2kdKUevq', 'nHbkWCC6Rh', 'I4Ukf1XC2h', 'sfnkHh6gbw', 'ck4k4U6gGO', 'r1qk9yrPPp'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, syv7QdNKtKblnuuuxd.cs	High entropy of concatenated method names: 'n6JGgvBfBc', 'WyeG0jS8VD', 'toncWaaqaK', 'ryAcf7Tv6W', 'EJQcH9DjBF', 'jONc4schkH', 'g1Dc90c0iV', 'Dt2cJnitZx', 'Mx7cmivFXr', 'gjKcRWLAh4'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, SbBo3aTf4cNGFXq9s0.cs	High entropy of concatenated method names: 'cy0iNyYDXo', 'wsiiFxWRwt', 'DyTiSQtMO3', 's4xibu9GTp', 'MumigNNe82', 'E8Die6JJ0T', 'Sf4i0KijoF', 'aeLiY01KNP', 'w92iA8FhrJ', 'KDlivZS8Eh'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, u2YxUHxItJFpKQdbGU.cs	High entropy of concatenated method names: 'ToString', 'ejjy86Wpgx', 'dumydcR8nU', 'EjbyWFgZEe', 'z0Vyfmw7oU', 'vmbyHvjoGV', 'hD9y4BaQQF', 'lRny9yuOHw', 'nIhyJV3ASg', 'FvJymXBY1G'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, R8F35CDOHwNew9N6HY.cs	High entropy of concatenated method names: 'Dispose', 'bLhX6xDWY1', 'HhNCdHkkuR', 'QkJqq8Tk0q', 'WwLXEaG89i', 'bRNXzsb5yg', 'ProcessDialogKey', 'C3RCQRqA7L', 'TkHCXaPEYI', 'NQYCCkRIvR'
Source: 3.2.Quote35664776.exe.45700b8.2.raw.unpack, Omg99GFnvJiuifGl2TV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RL6OnckV1V', 'I3qOZooGr0', 'IUZOuRFDZR', 'qC5OaVVAKs', 'UMDOLS2ElB', 'z6FOhPgT43', 'LnROwXhZcl'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Quote35664776.exe PID: 6448, type: MEMORYSTR

Source: C:\Users\user\Desktop\Quote35664776.exe	Memory allocated: 10C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Memory allocated: 4AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Memory allocated: 6FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Memory allocated: 7FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Memory allocated: 8160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Memory allocated: 9160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Memory allocated: 9C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Memory allocated: AC50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Memory allocated: BC50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Quote35664776.exe

Code function: 7_2_0151096E rdtsc

7_2_0151096E

Source: C:\Users\user\Desktop\Quote35664776.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5152			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3000			Jump to behavior

Source: C:\Users\user\Desktop\Quote35664776.exe

API coverage: 0.6 %

Source: C:\Users\user\Desktop\Quote35664776.exe TID: 6240	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7428	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7408	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe TID: 7304	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Quote35664776.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Quote35664776.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\Quote35664776.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\Quote35664776.exe

Code function: 7_2_0151096E rdtsc

7_2_0151096E

Source: C:\Users\user\Desktop\Quote35664776.exe

Code function: 7_2_004176E3 LdrLoadDll,

7_2_004176E3

Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01568158 mov eax, dword ptr fs:[00000030h]	7_2_01568158
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01564144 mov eax, dword ptr fs:[00000030h]	7_2_01564144
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01564144 mov eax, dword ptr fs:[00000030h]	7_2_01564144
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01564144 mov ecx, dword ptr fs:[00000030h]	7_2_01564144
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01564144 mov eax, dword ptr fs:[00000030h]	7_2_01564144
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01564144 mov eax, dword ptr fs:[00000030h]	7_2_01564144
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D6154 mov eax, dword ptr fs:[00000030h]	7_2_014D6154
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D6154 mov eax, dword ptr fs:[00000030h]	7_2_014D6154
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CC156 mov eax, dword ptr fs:[00000030h]	7_2_014CC156
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A4164 mov eax, dword ptr fs:[00000030h]	7_2_015A4164
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A4164 mov eax, dword ptr fs:[00000030h]	7_2_015A4164
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01590115 mov eax, dword ptr fs:[00000030h]	7_2_01590115
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157A118 mov ecx, dword ptr fs:[00000030h]	7_2_0157A118
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157A118 mov eax, dword ptr fs:[00000030h]	7_2_0157A118
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157A118 mov eax, dword ptr fs:[00000030h]	7_2_0157A118
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157A118 mov eax, dword ptr fs:[00000030h]	7_2_0157A118
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h]	7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E10E mov ecx, dword ptr fs:[00000030h]	7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h]	7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h]	7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E10E mov ecx, dword ptr fs:[00000030h]	7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h]	7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h]	7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E10E mov ecx, dword ptr fs:[00000030h]	7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E10E mov eax, dword ptr fs:[00000030h]	7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E10E mov ecx, dword ptr fs:[00000030h]	7_2_0157E10E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01500124 mov eax, dword ptr fs:[00000030h]	7_2_01500124
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E1D0 mov eax, dword ptr fs:[00000030h]	7_2_0154E1D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E1D0 mov eax, dword ptr fs:[00000030h]	7_2_0154E1D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E1D0 mov ecx, dword ptr fs:[00000030h]	7_2_0154E1D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E1D0 mov eax, dword ptr fs:[00000030h]	7_2_0154E1D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E1D0 mov eax, dword ptr fs:[00000030h]	7_2_0154E1D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015961C3 mov eax, dword ptr fs:[00000030h]	7_2_015961C3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015961C3 mov eax, dword ptr fs:[00000030h]	7_2_015961C3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015001F8 mov eax, dword ptr fs:[00000030h]	7_2_015001F8
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A61E5 mov eax, dword ptr fs:[00000030h]	7_2_015A61E5
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155019F mov eax, dword ptr fs:[00000030h]	7_2_0155019F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155019F mov eax, dword ptr fs:[00000030h]	7_2_0155019F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155019F mov eax, dword ptr fs:[00000030h]	7_2_0155019F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155019F mov eax, dword ptr fs:[00000030h]	7_2_0155019F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0158C188 mov eax, dword ptr fs:[00000030h]	7_2_0158C188
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0158C188 mov eax, dword ptr fs:[00000030h]	7_2_0158C188
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01510185 mov eax, dword ptr fs:[00000030h]	7_2_01510185
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01574180 mov eax, dword ptr fs:[00000030h]	7_2_01574180
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01574180 mov eax, dword ptr fs:[00000030h]	7_2_01574180
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CA197 mov eax, dword ptr fs:[00000030h]	7_2_014CA197
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CA197 mov eax, dword ptr fs:[00000030h]	7_2_014CA197
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CA197 mov eax, dword ptr fs:[00000030h]	7_2_014CA197
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01556050 mov eax, dword ptr fs:[00000030h]	7_2_01556050
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D2050 mov eax, dword ptr fs:[00000030h]	7_2_014D2050
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FC073 mov eax, dword ptr fs:[00000030h]	7_2_014FC073
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01554000 mov ecx, dword ptr fs:[00000030h]	7_2_01554000
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h]	7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h]	7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h]	7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h]	7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h]	7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h]	7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h]	7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01572000 mov eax, dword ptr fs:[00000030h]	7_2_01572000
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EE016 mov eax, dword ptr fs:[00000030h]	7_2_014EE016
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EE016 mov eax, dword ptr fs:[00000030h]	7_2_014EE016
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EE016 mov eax, dword ptr fs:[00000030h]	7_2_014EE016
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EE016 mov eax, dword ptr fs:[00000030h]	7_2_014EE016
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01566030 mov eax, dword ptr fs:[00000030h]	7_2_01566030
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CA020 mov eax, dword ptr fs:[00000030h]	7_2_014CA020
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CC020 mov eax, dword ptr fs:[00000030h]	7_2_014CC020
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015520DE mov eax, dword ptr fs:[00000030h]	7_2_015520DE
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015120F0 mov ecx, dword ptr fs:[00000030h]	7_2_015120F0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D80E9 mov eax, dword ptr fs:[00000030h]	7_2_014D80E9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CA0E3 mov ecx, dword ptr fs:[00000030h]	7_2_014CA0E3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015560E0 mov eax, dword ptr fs:[00000030h]	7_2_015560E0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CC0F0 mov eax, dword ptr fs:[00000030h]	7_2_014CC0F0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D208A mov eax, dword ptr fs:[00000030h]	7_2_014D208A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015960B8 mov eax, dword ptr fs:[00000030h]	7_2_015960B8
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015960B8 mov ecx, dword ptr fs:[00000030h]	7_2_015960B8
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014C80A0 mov eax, dword ptr fs:[00000030h]	7_2_014C80A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015680A8 mov eax, dword ptr fs:[00000030h]	7_2_015680A8
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01578350 mov ecx, dword ptr fs:[00000030h]	7_2_01578350
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155035C mov eax, dword ptr fs:[00000030h]	7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155035C mov eax, dword ptr fs:[00000030h]	7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155035C mov eax, dword ptr fs:[00000030h]	7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155035C mov ecx, dword ptr fs:[00000030h]	7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155035C mov eax, dword ptr fs:[00000030h]	7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155035C mov eax, dword ptr fs:[00000030h]	7_2_0155035C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159A352 mov eax, dword ptr fs:[00000030h]	7_2_0159A352
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A634F mov eax, dword ptr fs:[00000030h]	7_2_015A634F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01552349 mov eax, dword ptr fs:[00000030h]	7_2_01552349
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157437C mov eax, dword ptr fs:[00000030h]	7_2_0157437C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150A30B mov eax, dword ptr fs:[00000030h]	7_2_0150A30B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150A30B mov eax, dword ptr fs:[00000030h]	7_2_0150A30B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150A30B mov eax, dword ptr fs:[00000030h]	7_2_0150A30B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CC310 mov ecx, dword ptr fs:[00000030h]	7_2_014CC310
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F0310 mov ecx, dword ptr fs:[00000030h]	7_2_014F0310
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A8324 mov eax, dword ptr fs:[00000030h]	7_2_015A8324
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A8324 mov ecx, dword ptr fs:[00000030h]	7_2_015A8324
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A8324 mov eax, dword ptr fs:[00000030h]	7_2_015A8324
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A8324 mov eax, dword ptr fs:[00000030h]	7_2_015A8324
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015743D4 mov eax, dword ptr fs:[00000030h]	7_2_015743D4
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015743D4 mov eax, dword ptr fs:[00000030h]	7_2_015743D4
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E3DB mov eax, dword ptr fs:[00000030h]	7_2_0157E3DB
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E3DB mov eax, dword ptr fs:[00000030h]	7_2_0157E3DB
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E3DB mov ecx, dword ptr fs:[00000030h]	7_2_0157E3DB
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157E3DB mov eax, dword ptr fs:[00000030h]	7_2_0157E3DB
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_014DA3C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D83C0 mov eax, dword ptr fs:[00000030h]	7_2_014D83C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D83C0 mov eax, dword ptr fs:[00000030h]	7_2_014D83C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D83C0 mov eax, dword ptr fs:[00000030h]	7_2_014D83C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D83C0 mov eax, dword ptr fs:[00000030h]	7_2_014D83C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0158C3CD mov eax, dword ptr fs:[00000030h]	7_2_0158C3CD
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015563C0 mov eax, dword ptr fs:[00000030h]	7_2_015563C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h]	7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h]	7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h]	7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h]	7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h]	7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h]	7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h]	7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E03E9 mov eax, dword ptr fs:[00000030h]	7_2_014E03E9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015063FF mov eax, dword ptr fs:[00000030h]	7_2_015063FF
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EE3F0 mov eax, dword ptr fs:[00000030h]	7_2_014EE3F0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EE3F0 mov eax, dword ptr fs:[00000030h]	7_2_014EE3F0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EE3F0 mov eax, dword ptr fs:[00000030h]	7_2_014EE3F0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F438F mov eax, dword ptr fs:[00000030h]	7_2_014F438F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F438F mov eax, dword ptr fs:[00000030h]	7_2_014F438F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CE388 mov eax, dword ptr fs:[00000030h]	7_2_014CE388
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CE388 mov eax, dword ptr fs:[00000030h]	7_2_014CE388
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CE388 mov eax, dword ptr fs:[00000030h]	7_2_014CE388
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014C8397 mov eax, dword ptr fs:[00000030h]	7_2_014C8397
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014C8397 mov eax, dword ptr fs:[00000030h]	7_2_014C8397
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014C8397 mov eax, dword ptr fs:[00000030h]	7_2_014C8397
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A625D mov eax, dword ptr fs:[00000030h]	7_2_015A625D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0158A250 mov eax, dword ptr fs:[00000030h]	7_2_0158A250
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0158A250 mov eax, dword ptr fs:[00000030h]	7_2_0158A250
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D6259 mov eax, dword ptr fs:[00000030h]	7_2_014D6259
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01558243 mov eax, dword ptr fs:[00000030h]	7_2_01558243
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01558243 mov ecx, dword ptr fs:[00000030h]	7_2_01558243
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CA250 mov eax, dword ptr fs:[00000030h]	7_2_014CA250
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014C826B mov eax, dword ptr fs:[00000030h]	7_2_014C826B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01580274 mov eax, dword ptr fs:[00000030h]	7_2_01580274
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D4260 mov eax, dword ptr fs:[00000030h]	7_2_014D4260
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D4260 mov eax, dword ptr fs:[00000030h]	7_2_014D4260
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D4260 mov eax, dword ptr fs:[00000030h]	7_2_014D4260
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014C823B mov eax, dword ptr fs:[00000030h]	7_2_014C823B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A62D6 mov eax, dword ptr fs:[00000030h]	7_2_015A62D6
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA2C3 mov eax, dword ptr fs:[00000030h]	7_2_014DA2C3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA2C3 mov eax, dword ptr fs:[00000030h]	7_2_014DA2C3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA2C3 mov eax, dword ptr fs:[00000030h]	7_2_014DA2C3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA2C3 mov eax, dword ptr fs:[00000030h]	7_2_014DA2C3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA2C3 mov eax, dword ptr fs:[00000030h]	7_2_014DA2C3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E02E1 mov eax, dword ptr fs:[00000030h]	7_2_014E02E1
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E02E1 mov eax, dword ptr fs:[00000030h]	7_2_014E02E1
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E02E1 mov eax, dword ptr fs:[00000030h]	7_2_014E02E1
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E284 mov eax, dword ptr fs:[00000030h]	7_2_0150E284
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E284 mov eax, dword ptr fs:[00000030h]	7_2_0150E284
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01550283 mov eax, dword ptr fs:[00000030h]	7_2_01550283
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01550283 mov eax, dword ptr fs:[00000030h]	7_2_01550283
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01550283 mov eax, dword ptr fs:[00000030h]	7_2_01550283
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E02A0 mov eax, dword ptr fs:[00000030h]	7_2_014E02A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E02A0 mov eax, dword ptr fs:[00000030h]	7_2_014E02A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015662A0 mov eax, dword ptr fs:[00000030h]	7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015662A0 mov ecx, dword ptr fs:[00000030h]	7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015662A0 mov eax, dword ptr fs:[00000030h]	7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015662A0 mov eax, dword ptr fs:[00000030h]	7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015662A0 mov eax, dword ptr fs:[00000030h]	7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015662A0 mov eax, dword ptr fs:[00000030h]	7_2_015662A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D8550 mov eax, dword ptr fs:[00000030h]	7_2_014D8550
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D8550 mov eax, dword ptr fs:[00000030h]	7_2_014D8550
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150656A mov eax, dword ptr fs:[00000030h]	7_2_0150656A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150656A mov eax, dword ptr fs:[00000030h]	7_2_0150656A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150656A mov eax, dword ptr fs:[00000030h]	7_2_0150656A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01566500 mov eax, dword ptr fs:[00000030h]	7_2_01566500
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h]	7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h]	7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h]	7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h]	7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h]	7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h]	7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A4500 mov eax, dword ptr fs:[00000030h]	7_2_015A4500
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE53E mov eax, dword ptr fs:[00000030h]	7_2_014FE53E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE53E mov eax, dword ptr fs:[00000030h]	7_2_014FE53E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE53E mov eax, dword ptr fs:[00000030h]	7_2_014FE53E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE53E mov eax, dword ptr fs:[00000030h]	7_2_014FE53E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE53E mov eax, dword ptr fs:[00000030h]	7_2_014FE53E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h]	7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h]	7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h]	7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h]	7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h]	7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0535 mov eax, dword ptr fs:[00000030h]	7_2_014E0535
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150A5D0 mov eax, dword ptr fs:[00000030h]	7_2_0150A5D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150A5D0 mov eax, dword ptr fs:[00000030h]	7_2_0150A5D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D65D0 mov eax, dword ptr fs:[00000030h]	7_2_014D65D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E5CF mov eax, dword ptr fs:[00000030h]	7_2_0150E5CF
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E5CF mov eax, dword ptr fs:[00000030h]	7_2_0150E5CF
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_014FE5E7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D25E0 mov eax, dword ptr fs:[00000030h]	7_2_014D25E0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150C5ED mov eax, dword ptr fs:[00000030h]	7_2_0150C5ED
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150C5ED mov eax, dword ptr fs:[00000030h]	7_2_0150C5ED
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E59C mov eax, dword ptr fs:[00000030h]	7_2_0150E59C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D2582 mov eax, dword ptr fs:[00000030h]	7_2_014D2582
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D2582 mov ecx, dword ptr fs:[00000030h]	7_2_014D2582
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01504588 mov eax, dword ptr fs:[00000030h]	7_2_01504588
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015505A7 mov eax, dword ptr fs:[00000030h]	7_2_015505A7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015505A7 mov eax, dword ptr fs:[00000030h]	7_2_015505A7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015505A7 mov eax, dword ptr fs:[00000030h]	7_2_015505A7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F45B1 mov eax, dword ptr fs:[00000030h]	7_2_014F45B1
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F45B1 mov eax, dword ptr fs:[00000030h]	7_2_014F45B1
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0158A456 mov eax, dword ptr fs:[00000030h]	7_2_0158A456
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014C645D mov eax, dword ptr fs:[00000030h]	7_2_014C645D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h]	7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h]	7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h]	7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h]	7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h]	7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h]	7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h]	7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150E443 mov eax, dword ptr fs:[00000030h]	7_2_0150E443
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F245A mov eax, dword ptr fs:[00000030h]	7_2_014F245A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155C460 mov ecx, dword ptr fs:[00000030h]	7_2_0155C460
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FA470 mov eax, dword ptr fs:[00000030h]	7_2_014FA470
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FA470 mov eax, dword ptr fs:[00000030h]	7_2_014FA470
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FA470 mov eax, dword ptr fs:[00000030h]	7_2_014FA470
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01508402 mov eax, dword ptr fs:[00000030h]	7_2_01508402
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01508402 mov eax, dword ptr fs:[00000030h]	7_2_01508402
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01508402 mov eax, dword ptr fs:[00000030h]	7_2_01508402
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150A430 mov eax, dword ptr fs:[00000030h]	7_2_0150A430
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CC427 mov eax, dword ptr fs:[00000030h]	7_2_014CC427
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CE420 mov eax, dword ptr fs:[00000030h]	7_2_014CE420
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CE420 mov eax, dword ptr fs:[00000030h]	7_2_014CE420
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CE420 mov eax, dword ptr fs:[00000030h]	7_2_014CE420
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h]	7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h]	7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h]	7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h]	7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h]	7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h]	7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01556420 mov eax, dword ptr fs:[00000030h]	7_2_01556420
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D04E5 mov ecx, dword ptr fs:[00000030h]	7_2_014D04E5
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0158A49A mov eax, dword ptr fs:[00000030h]	7_2_0158A49A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015044B0 mov ecx, dword ptr fs:[00000030h]	7_2_015044B0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155A4B0 mov eax, dword ptr fs:[00000030h]	7_2_0155A4B0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D64AB mov eax, dword ptr fs:[00000030h]	7_2_014D64AB
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01554755 mov eax, dword ptr fs:[00000030h]	7_2_01554755
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512750 mov eax, dword ptr fs:[00000030h]	7_2_01512750
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512750 mov eax, dword ptr fs:[00000030h]	7_2_01512750
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155E75D mov eax, dword ptr fs:[00000030h]	7_2_0155E75D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D0750 mov eax, dword ptr fs:[00000030h]	7_2_014D0750
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150674D mov esi, dword ptr fs:[00000030h]	7_2_0150674D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150674D mov eax, dword ptr fs:[00000030h]	7_2_0150674D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150674D mov eax, dword ptr fs:[00000030h]	7_2_0150674D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D8770 mov eax, dword ptr fs:[00000030h]	7_2_014D8770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0770 mov eax, dword ptr fs:[00000030h]	7_2_014E0770
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01500710 mov eax, dword ptr fs:[00000030h]	7_2_01500710
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150C700 mov eax, dword ptr fs:[00000030h]	7_2_0150C700
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D0710 mov eax, dword ptr fs:[00000030h]	7_2_014D0710
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154C730 mov eax, dword ptr fs:[00000030h]	7_2_0154C730
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150273C mov eax, dword ptr fs:[00000030h]	7_2_0150273C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150273C mov ecx, dword ptr fs:[00000030h]	7_2_0150273C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150273C mov eax, dword ptr fs:[00000030h]	7_2_0150273C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150C720 mov eax, dword ptr fs:[00000030h]	7_2_0150C720
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150C720 mov eax, dword ptr fs:[00000030h]	7_2_0150C720
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DC7C0 mov eax, dword ptr fs:[00000030h]	7_2_014DC7C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015507C3 mov eax, dword ptr fs:[00000030h]	7_2_015507C3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F27ED mov eax, dword ptr fs:[00000030h]	7_2_014F27ED
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F27ED mov eax, dword ptr fs:[00000030h]	7_2_014F27ED
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F27ED mov eax, dword ptr fs:[00000030h]	7_2_014F27ED
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155E7E1 mov eax, dword ptr fs:[00000030h]	7_2_0155E7E1
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D47FB mov eax, dword ptr fs:[00000030h]	7_2_014D47FB
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D47FB mov eax, dword ptr fs:[00000030h]	7_2_014D47FB
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157678E mov eax, dword ptr fs:[00000030h]	7_2_0157678E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D07AF mov eax, dword ptr fs:[00000030h]	7_2_014D07AF
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015847A0 mov eax, dword ptr fs:[00000030h]	7_2_015847A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EC640 mov eax, dword ptr fs:[00000030h]	7_2_014EC640
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01502674 mov eax, dword ptr fs:[00000030h]	7_2_01502674
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150A660 mov eax, dword ptr fs:[00000030h]	7_2_0150A660
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150A660 mov eax, dword ptr fs:[00000030h]	7_2_0150A660
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159866E mov eax, dword ptr fs:[00000030h]	7_2_0159866E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159866E mov eax, dword ptr fs:[00000030h]	7_2_0159866E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h]	7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h]	7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h]	7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h]	7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h]	7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h]	7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E260B mov eax, dword ptr fs:[00000030h]	7_2_014E260B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01512619 mov eax, dword ptr fs:[00000030h]	7_2_01512619
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E609 mov eax, dword ptr fs:[00000030h]	7_2_0154E609
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D262C mov eax, dword ptr fs:[00000030h]	7_2_014D262C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014EE627 mov eax, dword ptr fs:[00000030h]	7_2_014EE627
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01506620 mov eax, dword ptr fs:[00000030h]	7_2_01506620
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01508620 mov eax, dword ptr fs:[00000030h]	7_2_01508620
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150A6C7 mov ebx, dword ptr fs:[00000030h]	7_2_0150A6C7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150A6C7 mov eax, dword ptr fs:[00000030h]	7_2_0150A6C7
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015506F1 mov eax, dword ptr fs:[00000030h]	7_2_015506F1
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015506F1 mov eax, dword ptr fs:[00000030h]	7_2_015506F1
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E6F2 mov eax, dword ptr fs:[00000030h]	7_2_0154E6F2
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E6F2 mov eax, dword ptr fs:[00000030h]	7_2_0154E6F2
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E6F2 mov eax, dword ptr fs:[00000030h]	7_2_0154E6F2
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E6F2 mov eax, dword ptr fs:[00000030h]	7_2_0154E6F2
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D4690 mov eax, dword ptr fs:[00000030h]	7_2_014D4690
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D4690 mov eax, dword ptr fs:[00000030h]	7_2_014D4690
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015066B0 mov eax, dword ptr fs:[00000030h]	7_2_015066B0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150C6A6 mov eax, dword ptr fs:[00000030h]	7_2_0150C6A6
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01550946 mov eax, dword ptr fs:[00000030h]	7_2_01550946
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A4940 mov eax, dword ptr fs:[00000030h]	7_2_015A4940
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155C97C mov eax, dword ptr fs:[00000030h]	7_2_0155C97C
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F6962 mov eax, dword ptr fs:[00000030h]	7_2_014F6962
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F6962 mov eax, dword ptr fs:[00000030h]	7_2_014F6962
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F6962 mov eax, dword ptr fs:[00000030h]	7_2_014F6962
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01574978 mov eax, dword ptr fs:[00000030h]	7_2_01574978
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01574978 mov eax, dword ptr fs:[00000030h]	7_2_01574978
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0151096E mov eax, dword ptr fs:[00000030h]	7_2_0151096E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0151096E mov edx, dword ptr fs:[00000030h]	7_2_0151096E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0151096E mov eax, dword ptr fs:[00000030h]	7_2_0151096E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155C912 mov eax, dword ptr fs:[00000030h]	7_2_0155C912
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014C8918 mov eax, dword ptr fs:[00000030h]	7_2_014C8918
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014C8918 mov eax, dword ptr fs:[00000030h]	7_2_014C8918
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E908 mov eax, dword ptr fs:[00000030h]	7_2_0154E908
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154E908 mov eax, dword ptr fs:[00000030h]	7_2_0154E908
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0156892B mov eax, dword ptr fs:[00000030h]	7_2_0156892B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155892A mov eax, dword ptr fs:[00000030h]	7_2_0155892A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015049D0 mov eax, dword ptr fs:[00000030h]	7_2_015049D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159A9D3 mov eax, dword ptr fs:[00000030h]	7_2_0159A9D3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015669C0 mov eax, dword ptr fs:[00000030h]	7_2_015669C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h]	7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h]	7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h]	7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h]	7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h]	7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DA9D0 mov eax, dword ptr fs:[00000030h]	7_2_014DA9D0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015029F9 mov eax, dword ptr fs:[00000030h]	7_2_015029F9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015029F9 mov eax, dword ptr fs:[00000030h]	7_2_015029F9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155E9E0 mov eax, dword ptr fs:[00000030h]	7_2_0155E9E0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D09AD mov eax, dword ptr fs:[00000030h]	7_2_014D09AD
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D09AD mov eax, dword ptr fs:[00000030h]	7_2_014D09AD
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015589B3 mov esi, dword ptr fs:[00000030h]	7_2_015589B3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015589B3 mov eax, dword ptr fs:[00000030h]	7_2_015589B3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015589B3 mov eax, dword ptr fs:[00000030h]	7_2_015589B3
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E29A0 mov eax, dword ptr fs:[00000030h]	7_2_014E29A0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01500854 mov eax, dword ptr fs:[00000030h]	7_2_01500854
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E2840 mov ecx, dword ptr fs:[00000030h]	7_2_014E2840
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D4859 mov eax, dword ptr fs:[00000030h]	7_2_014D4859
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D4859 mov eax, dword ptr fs:[00000030h]	7_2_014D4859
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01566870 mov eax, dword ptr fs:[00000030h]	7_2_01566870
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01566870 mov eax, dword ptr fs:[00000030h]	7_2_01566870
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155E872 mov eax, dword ptr fs:[00000030h]	7_2_0155E872
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155E872 mov eax, dword ptr fs:[00000030h]	7_2_0155E872
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155C810 mov eax, dword ptr fs:[00000030h]	7_2_0155C810
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150A830 mov eax, dword ptr fs:[00000030h]	7_2_0150A830
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157483A mov eax, dword ptr fs:[00000030h]	7_2_0157483A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157483A mov eax, dword ptr fs:[00000030h]	7_2_0157483A
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F2835 mov eax, dword ptr fs:[00000030h]	7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F2835 mov eax, dword ptr fs:[00000030h]	7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F2835 mov eax, dword ptr fs:[00000030h]	7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F2835 mov ecx, dword ptr fs:[00000030h]	7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F2835 mov eax, dword ptr fs:[00000030h]	7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F2835 mov eax, dword ptr fs:[00000030h]	7_2_014F2835
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FE8C0 mov eax, dword ptr fs:[00000030h]	7_2_014FE8C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A08C0 mov eax, dword ptr fs:[00000030h]	7_2_015A08C0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150C8F9 mov eax, dword ptr fs:[00000030h]	7_2_0150C8F9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150C8F9 mov eax, dword ptr fs:[00000030h]	7_2_0150C8F9
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159A8E4 mov eax, dword ptr fs:[00000030h]	7_2_0159A8E4
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155C89D mov eax, dword ptr fs:[00000030h]	7_2_0155C89D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D0887 mov eax, dword ptr fs:[00000030h]	7_2_014D0887
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157EB50 mov eax, dword ptr fs:[00000030h]	7_2_0157EB50
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A2B57 mov eax, dword ptr fs:[00000030h]	7_2_015A2B57
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A2B57 mov eax, dword ptr fs:[00000030h]	7_2_015A2B57
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A2B57 mov eax, dword ptr fs:[00000030h]	7_2_015A2B57
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A2B57 mov eax, dword ptr fs:[00000030h]	7_2_015A2B57
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01584B4B mov eax, dword ptr fs:[00000030h]	7_2_01584B4B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01584B4B mov eax, dword ptr fs:[00000030h]	7_2_01584B4B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01578B42 mov eax, dword ptr fs:[00000030h]	7_2_01578B42
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01566B40 mov eax, dword ptr fs:[00000030h]	7_2_01566B40
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01566B40 mov eax, dword ptr fs:[00000030h]	7_2_01566B40
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0159AB40 mov eax, dword ptr fs:[00000030h]	7_2_0159AB40
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014C8B50 mov eax, dword ptr fs:[00000030h]	7_2_014C8B50
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014CCB7E mov eax, dword ptr fs:[00000030h]	7_2_014CCB7E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h]	7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h]	7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h]	7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h]	7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h]	7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h]	7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h]	7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h]	7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154EB1D mov eax, dword ptr fs:[00000030h]	7_2_0154EB1D
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_015A4B00 mov eax, dword ptr fs:[00000030h]	7_2_015A4B00
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FEB20 mov eax, dword ptr fs:[00000030h]	7_2_014FEB20
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FEB20 mov eax, dword ptr fs:[00000030h]	7_2_014FEB20
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01598B28 mov eax, dword ptr fs:[00000030h]	7_2_01598B28
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01598B28 mov eax, dword ptr fs:[00000030h]	7_2_01598B28
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D0BCD mov eax, dword ptr fs:[00000030h]	7_2_014D0BCD
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D0BCD mov eax, dword ptr fs:[00000030h]	7_2_014D0BCD
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D0BCD mov eax, dword ptr fs:[00000030h]	7_2_014D0BCD
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F0BCB mov eax, dword ptr fs:[00000030h]	7_2_014F0BCB
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F0BCB mov eax, dword ptr fs:[00000030h]	7_2_014F0BCB
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F0BCB mov eax, dword ptr fs:[00000030h]	7_2_014F0BCB
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157EBD0 mov eax, dword ptr fs:[00000030h]	7_2_0157EBD0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155CBF0 mov eax, dword ptr fs:[00000030h]	7_2_0155CBF0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FEBFC mov eax, dword ptr fs:[00000030h]	7_2_014FEBFC
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D8BF0 mov eax, dword ptr fs:[00000030h]	7_2_014D8BF0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D8BF0 mov eax, dword ptr fs:[00000030h]	7_2_014D8BF0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D8BF0 mov eax, dword ptr fs:[00000030h]	7_2_014D8BF0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01584BB0 mov eax, dword ptr fs:[00000030h]	7_2_01584BB0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01584BB0 mov eax, dword ptr fs:[00000030h]	7_2_01584BB0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0BBE mov eax, dword ptr fs:[00000030h]	7_2_014E0BBE
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0BBE mov eax, dword ptr fs:[00000030h]	7_2_014E0BBE
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0A5B mov eax, dword ptr fs:[00000030h]	7_2_014E0A5B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014E0A5B mov eax, dword ptr fs:[00000030h]	7_2_014E0A5B
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h]	7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h]	7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h]	7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h]	7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h]	7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h]	7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D6A50 mov eax, dword ptr fs:[00000030h]	7_2_014D6A50
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154CA72 mov eax, dword ptr fs:[00000030h]	7_2_0154CA72
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0154CA72 mov eax, dword ptr fs:[00000030h]	7_2_0154CA72
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0157EA60 mov eax, dword ptr fs:[00000030h]	7_2_0157EA60
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150CA6F mov eax, dword ptr fs:[00000030h]	7_2_0150CA6F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150CA6F mov eax, dword ptr fs:[00000030h]	7_2_0150CA6F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150CA6F mov eax, dword ptr fs:[00000030h]	7_2_0150CA6F
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0155CA11 mov eax, dword ptr fs:[00000030h]	7_2_0155CA11
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014FEA2E mov eax, dword ptr fs:[00000030h]	7_2_014FEA2E
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150CA38 mov eax, dword ptr fs:[00000030h]	7_2_0150CA38
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150CA24 mov eax, dword ptr fs:[00000030h]	7_2_0150CA24
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F4A35 mov eax, dword ptr fs:[00000030h]	7_2_014F4A35
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014F4A35 mov eax, dword ptr fs:[00000030h]	7_2_014F4A35
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01504AD0 mov eax, dword ptr fs:[00000030h]	7_2_01504AD0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01504AD0 mov eax, dword ptr fs:[00000030h]	7_2_01504AD0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014D0AD0 mov eax, dword ptr fs:[00000030h]	7_2_014D0AD0
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01526ACC mov eax, dword ptr fs:[00000030h]	7_2_01526ACC
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01526ACC mov eax, dword ptr fs:[00000030h]	7_2_01526ACC
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01526ACC mov eax, dword ptr fs:[00000030h]	7_2_01526ACC
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150AAEE mov eax, dword ptr fs:[00000030h]	7_2_0150AAEE
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_0150AAEE mov eax, dword ptr fs:[00000030h]	7_2_0150AAEE
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_01508A90 mov edx, dword ptr fs:[00000030h]	7_2_01508A90
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DEA80 mov eax, dword ptr fs:[00000030h]	7_2_014DEA80
Source: C:\Users\user\Desktop\Quote35664776.exe	Code function: 7_2_014DEA80 mov eax, dword ptr fs:[00000030h]	7_2_014DEA80

Source: C:\Users\user\Desktop\Quote35664776.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Quote35664776.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\Quote35664776.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote35664776.exe"
Source: C:\Users\user\Desktop\Quote35664776.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote35664776.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Quote35664776.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote35664776.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Process created: C:\Users\user\Desktop\Quote35664776.exe "C:\Users\user\Desktop\Quote35664776.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Quote35664776.exe	Queries volume information: C:\Users\user\Desktop\Quote35664776.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote35664776.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Quote35664776.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 7.2.Quote35664776.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Quote35664776.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Quote35664776.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeLogger
Quote35664776.exe	100%	Avira	HEUR/AGEN.1305635
Quote35664776.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Quote35664776.exe, 00000003.00000002.1331118649.0000000002D2D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543824
Start date and time:	2024-10-28 14:24:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Quote35664776.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/6@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 33 Number of non-executed functions: 264
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Quote35664776.exe

Simulations

Behavior and APIs

Time	Type	Description
09:25:04	API Interceptor	4x Sleep call for process: Quote35664776.exe modified
09:25:05	API Interceptor	28x Sleep call for process: powershell.exe modified

Process:	C:\Users\user\Desktop\Quote35664776.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4xympjgZ9tz4RIoUl8NPZHUl7u1iMugeC/ZM0Uyus:lGLHxvCZfIfSKRHmOugw1s
MD5:	A6C11D5EB8FF113F746691904CC1C285
SHA1:	85159530ED2933460F7D0793776D5FC2B1FAE500
SHA-256:	7C1AA4858AF77BB1C1ADA78CE4816C4178A74E0A9CCFDB1E7F6A6FA3A08D6A1B
SHA-512:	3460404875D62BD2318704741E443A0EF38352E977EEEE5EC7C39E6FCE9596D7E0F0A401780993697AE21FB68E2B9A9AF3A662667FB9EA48D7DD8E5B6148AF1E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_auxzxpwz.0ck.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_if0mrgnt.uxi.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_op5bbgn2.ayq.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t32hqeow.beo.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.971865396931729
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Quote35664776.exe
File size:	733'184 bytes
MD5:	560b914d9a5652a2cd8e91885a866954
SHA1:	e516c3e218ab80245f3f2eb1502a1ecb07e69ba3
SHA256:	bcca185afcdcd92fde60a3d4676f7efd40126e9ce50d9971f7e725bd04b8bfb4
SHA512:	fea75c98468a853a7af9068c28c2342e52ec753d1fabd4b82c23b6198b2cf926912b99b76f99ad24f620b4719f5e93b07f43e04fc05586e5d53ea45b4fbab591
SSDEEP:	12288:mMfzuSQarUz6rgz03UoSLXpY7biYbhvFDmO2saTexUnBq9/RVTrnqo:ms3rBlUoSLuviY1vFDr3xkUxRBnq
TLSH:	54F4231432588FA8F9AC43FF8D307A489BB82447BA95F548BFE451CB5537F920191B2B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....lc...............0..$..........nB... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4b426e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x89636CF8 [Fri Jan 16 04:15:52 2043 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb421a	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb6000	0x620	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb2b14	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb2274	0xb2400	001434d72924c196ad46477bcbbb286d	False	0.9764693636044881	data	7.977991168390122	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb6000	0x620	0x800	2912a0276301ba22f69c7c604e75fd30	False	0.3369140625	data	3.4652399053043994	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb8000	0xc	0x200	aab9d2a5f853978700819446d943a8ae	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb6090	0x390	data			0.42653508771929827
RT_MANIFEST	0xb6430	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Target ID:	3
Start time:	09:25:03
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\Quote35664776.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quote35664776.exe"
Imagebase:	0x680000
File size:	733'184 bytes
MD5 hash:	560B914D9A5652A2CD8E91885A866954
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	09:25:04
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote35664776.exe"
Imagebase:	0x630000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	09:25:04
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\Quote35664776.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quote35664776.exe"
Imagebase:	0x8f0000
File size:	733'184 bytes
MD5 hash:	560B914D9A5652A2CD8E91885A866954
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.1359589287.0000000001340000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.1358925300.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	09:25:04
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x5b0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	09:25:08
Start date:	28/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7fb730000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false