Edit tour

Windows Analysis Report
Quotation.exe

Overview

General Information

Sample name:	Quotation.exe
Analysis ID:	1558498
MD5:	404a7ca256047297656926bbea03415f
SHA1:	de02afb6d97f497ddaa0025a358b501a1ee942e4
SHA256:	f03acdb2a846f8060d76c3d81651949b5699a5dee5b2b26ec238872defd12252
Tags:	AgentTeslaexeuser-threatcat_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Quotation.exe (PID: 6536 cmdline: "C:\Users\user\Desktop\Quotation.exe" MD5: 404A7CA256047297656926BBEA03415F)

powershell.exe (PID: 1476 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7376 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

Quotation.exe (PID: 1260 cmdline: "C:\Users\user\Desktop\Quotation.exe" MD5: 404A7CA256047297656926BBEA03415F)

Quotation.exe (PID: 6356 cmdline: "C:\Users\user\Desktop\Quotation.exe" MD5: 404A7CA256047297656926BBEA03415F)

Quotation.exe (PID: 1792 cmdline: "C:\Users\user\Desktop\Quotation.exe" MD5: 404A7CA256047297656926BBEA03415F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.showpiece.trillennium.biz", "Username": "build@showpiece.trillennium.biz", "Password": "3KJ[T.3]fsSW"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.3738165227.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.3738165227.0000000002B76000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.3738165227.0000000002B76000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Quotation.exe PID: 6536	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Quotation.exe PID: 6536	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Quotation.exe PID: 6536	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Quotation.exe PID: 1792	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Quotation.exe PID: 1792	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.Quotation.exe.364b6e0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.Quotation.exe.364b6e0.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.Quotation.exe.3686100.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.Quotation.exe.3686100.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.Quotation.exe.364b6e0.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31763:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317ed:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3195b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a81:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.Quotation.exe.3686100.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31763:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317ed:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3195b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a81:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
13.2.Quotation.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.Quotation.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
13.2.Quotation.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33563:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335ed:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3375b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33881:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.Quotation.exe.3686100.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.Quotation.exe.3686100.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.Quotation.exe.3686100.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.Quotation.exe.3686100.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33563:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335ed:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3375b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33881:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.Quotation.exe.364b6e0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.Quotation.exe.364b6e0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.Quotation.exe.364b6e0.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.Quotation.exe.364b6e0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df11:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33563:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df83:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335ed:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e00d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e09f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e109:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3375b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e17b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e211:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33881:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e2a1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Quotation.exe", ParentImage: C:\Users\user\Desktop\Quotation.exe, ParentProcessId: 6536, ParentProcessName: Quotation.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe", ProcessId: 1476, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 67.23.226.139, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Quotation.exe, Initiated: true, ProcessId: 1792, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Quotation.exe", ParentImage: C:\Users\user\Desktop\Quotation.exe, ParentProcessId: 6536, ParentProcessName: Quotation.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe", ProcessId: 1476, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.2.Quotation.exe.3686100.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.showpiece.trillennium.biz", "Username": "build@showpiece.trillennium.biz", "Password": "3KJ[T.3]fsSW"}

Multi AV Scanner detection for submitted file

Source: Quotation.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Quotation.exe

Joe Sandbox ML: detected

Source: Quotation.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Quotation.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: ifAP.pdbSHA256 source: Quotation.exe
Source:	Binary string: ifAP.pdb source: Quotation.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.Quotation.exe.3686100.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Quotation.exe.364b6e0.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.7:49706 -> 67.23.226.139:587

Source: Joe Sandbox View	IP Address: 67.23.226.139 67.23.226.139
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: DIMENOCUS DIMENOCUS

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.7:49706 -> 67.23.226.139:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.showpiece.trillennium.biz

Source: Quotation.exe, 0000000D.00000002.3738165227.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.showpiece.trillennium.biz
Source: Quotation.exe, 00000004.00000002.1292437166.00000000024A5000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 0000000D.00000002.3738165227.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Quotation.exe, 0000000D.00000002.3738165227.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://showpiece.trillennium.biz
Source: Quotation.exe	String found in binary or memory: http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources
Source: Quotation.exe, 00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Quotation.exe, 00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 0000000D.00000002.3738165227.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 4.2.Quotation.exe.3686100.3.raw.unpack, SKTzxzsJw.cs	.Net Code: pT1h
Source: 4.2.Quotation.exe.364b6e0.1.raw.unpack, SKTzxzsJw.cs	.Net Code: pT1h

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Quotation.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Quotation.exe

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.Quotation.exe.364b6e0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.Quotation.exe.3686100.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 13.2.Quotation.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.Quotation.exe.3686100.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.Quotation.exe.364b6e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Quotation.exe

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_0227A3F0	4_2_0227A3F0
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_0227D57C	4_2_0227D57C
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06A034B8	4_2_06A034B8
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06A02106	4_2_06A02106
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06A06669	4_2_06A06669
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06A06678	4_2_06A06678
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06A034A8	4_2_06A034A8
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06A0F5D8	4_2_06A0F5D8
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06A0F1A0	4_2_06A0F1A0
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06A0BCB8	4_2_06A0BCB8
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06B448A0	4_2_06B448A0
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06B40006	4_2_06B40006
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06B40040	4_2_06B40040
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 4_2_06B409F0	4_2_06B409F0
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_010BE0E9	13_2_010BE0E9
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_010B4A98	13_2_010B4A98
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_010BDC68	13_2_010BDC68
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_010B3E80	13_2_010B3E80
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_010B41C8	13_2_010B41C8
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_010BA920	13_2_010BA920
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_06976290	13_2_06976290
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_0697B2BB	13_2_0697B2BB
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_0697C220	13_2_0697C220
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_06975240	13_2_06975240
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_06973108	13_2_06973108
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_0697E440	13_2_0697E440
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_0697233A	13_2_0697233A
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_06977338	13_2_06977338
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_06970040	13_2_06970040
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_0697597B	13_2_0697597B

Source: Quotation.exe, 00000004.00000002.1297924184.00000000083A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Quotation.exe
Source: Quotation.exe, 00000004.00000002.1296833585.0000000006930000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Quotation.exe
Source: Quotation.exe, 00000004.00000002.1292437166.00000000024A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename00b93cc8-4625-4c9d-a44d-5996e806c5f9.exe4 vs Quotation.exe
Source: Quotation.exe, 00000004.00000000.1269450037.00000000000F6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameifAP.exeP vs Quotation.exe
Source: Quotation.exe, 00000004.00000002.1288501884.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Quotation.exe
Source: Quotation.exe, 00000004.00000002.1292437166.0000000002431000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Quotation.exe
Source: Quotation.exe, 00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename00b93cc8-4625-4c9d-a44d-5996e806c5f9.exe4 vs Quotation.exe
Source: Quotation.exe, 00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Quotation.exe
Source: Quotation.exe, 0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename00b93cc8-4625-4c9d-a44d-5996e806c5f9.exe4 vs Quotation.exe
Source: Quotation.exe, 0000000D.00000002.3734524572.0000000000AF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Quotation.exe
Source: Quotation.exe	Binary or memory string: OriginalFilenameifAP.exeP vs Quotation.exe

Source: Quotation.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.Quotation.exe.364b6e0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.Quotation.exe.3686100.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 13.2.Quotation.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.Quotation.exe.3686100.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.Quotation.exe.364b6e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Quotation.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 4.2.Quotation.exe.3686100.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.Quotation.exe.3686100.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.Quotation.exe.3686100.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.Quotation.exe.3686100.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.Quotation.exe.3686100.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.Quotation.exe.3686100.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.Quotation.exe.3686100.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.Quotation.exe.3686100.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, m11KElQoaGTS6ScoKL.cs	Security API names: _0020.SetAccessControl
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, m11KElQoaGTS6ScoKL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, m11KElQoaGTS6ScoKL.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, gnUSCu92R6bF7qGVZD.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, gnUSCu92R6bF7qGVZD.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, m11KElQoaGTS6ScoKL.cs	Security API names: _0020.SetAccessControl
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, m11KElQoaGTS6ScoKL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, m11KElQoaGTS6ScoKL.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/6@2/2

Source: C:\Users\user\Desktop\Quotation.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1384:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_seuynxxz.qqt.ps1

Jump to behavior

Source: Quotation.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Quotation.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Quotation.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Quotation.exe

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe"
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Quotation.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Quotation.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Quotation.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Quotation.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ifAP.pdbSHA256 source: Quotation.exe
Source:	Binary string: ifAP.pdb source: Quotation.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, m11KElQoaGTS6ScoKL.cs	.Net Code: hUNXbOQ8uN System.Reflection.Assembly.Load(byte[])
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, m11KElQoaGTS6ScoKL.cs	.Net Code: hUNXbOQ8uN System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_010B0C45 push ebx; retf	13_2_010B0C52
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_010B0C53 push ebx; retf	13_2_010B0C52
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 13_2_010B0C6D push edi; retf	13_2_010B0C7A

Source: Quotation.exe

Static PE information: section name: .text entropy: 7.945855715131603

Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, gnUSCu92R6bF7qGVZD.cs	High entropy of concatenated method names: 'RZBvgHWrZL', 'xlOvR7y92r', 'NT1vmu1aHi', 'gXFvF3uq5K', 'TafvBRPwMr', 'l5xv5AV5cU', 'eoRvrWsX6j', 'Aj0veL1KGO', 'DxGv1hZpCM', 'PaEvuMCsYg'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, eHT1T75IHvJ8sOUE38.cs	High entropy of concatenated method names: 'uqPEeKOPkI', 'am7EuHBoh6', 'P9jYwxEqW7', 'IL6YsGuJXR', 'cM7EDkbJ4F', 'y2PEi7xAbg', 'xgfEJr8alV', 'AHvEg7Ssvp', 'zHoEREL7AC', 'WKWEm8bM9X'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, LRZpgcvSu5EnCVpLXd.cs	High entropy of concatenated method names: 'Dispose', 'nTHs1YPDXJ', 'YcShngZIac', 'uBB0g0oNLZ', 'it3sueMDTU', 'tCvszwHlNA', 'ProcessDialogKey', 'Dfvhwa4LsD', 'xshhs3dIvB', 'K0PhhJJYhF'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, QW44ZNssmHdh1ViQKBq.cs	High entropy of concatenated method names: 'UMlMuE16JM', 'E9BMzdNXRO', 'rGhAwRq17H', 'Gw4Ask9hkv', 'oCdAhIYP8U', 'volALcxjfj', 'SRXAXUnVWi', 'S08ATEH1MK', 'YdMAtg4Hw3', 'KsdAvkMx9s'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, j8l8X3hGl6YEdJptKd.cs	High entropy of concatenated method names: 'aQ9bNUbPi', 'xne2YxFQw', 'gcUSLjEdW', 'm0FqZlYQj', 't6kHxmPOn', 'SmxIE5jlu', 'vtBQorYgb92uamuWtY', 'vLx0XoaIOkl1LbuvmQ', 'F60YCBCvT', 'lkaMEtehl'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, hSEuaEN37iorj9y7aG.cs	High entropy of concatenated method names: 'DCgC02o78d', 'IfTCZ1Jeh5', 'EsCCbnIYoY', 'Av0C26uQYx', 'k7sC8bVpvS', 'rd1CSH3WQ3', 'UiuCqnndvO', 'mMFC99o929', 'xyGCHGpXdU', 'MogCIZLFjv'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, bMPlLSJ9RqY9YkWwgi.cs	High entropy of concatenated method names: 'Ixm69MkUSq', 'oDL6HAd7EL', 'd77639gl9q', 'qtZ6nOfTwV', 'EnD6UD3LpM', 'Wcx6lvV3AB', 'C386OpvWv6', 'vHL6ayDFjl', 'nUe64kDd0m', 'DD26DmkAP5'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, WYve84rJfGTHYPDXJy.cs	High entropy of concatenated method names: 'Q87KfC9Q5J', 'tcIKEMq3ff', 'DiSKK8fJ7O', 'mprKA0VtjZ', 'rsYKob0KOb', 'OM6K7lSujQ', 'Dispose', 'AhUYtQNqQ2', 'oFfYv9yIsE', 'lbtYpomW2W'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, WTq2RLX5BngG5eQIvd.cs	High entropy of concatenated method names: 'BdpsCnUSCu', 'AR6sQbF7qG', 'egKsxywxRY', 'WhgsG3vRsu', 'xoasfw29H5', 'rPssjcO4fs', 'JfnmA6t9hWGbTPEyjA', 'fnkh9956AZ0UKogC56', 'IGwssDgf0e', 'M7csLN8Xsc'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, qn8HZVzKsW0qKGJ613.cs	High entropy of concatenated method names: 'CUBMSJRJL1', 'KfJM9WX3Td', 'r37MHf4oJk', 'v3LM3QJr3I', 'Y07Mn5Y53A', 'bmCMUOg4Rk', 'D7LMlr8SD1', 'b0tM7vgLvJ', 'x4NM0wLByi', 'dBVMZjhM4i'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, ocCpNTHgKywxRYehg3.cs	High entropy of concatenated method names: 'xQQp2aKZ7i', 'TqppSGNarO', 'sZxp9eByrx', 'FtYpHegpef', 'w9Epf7EH6W', 'fhRpjXqRiL', 'NwYpEpamqu', 'gEFpY4tgNR', 'dwnpKVYynT', 'Un6pMbURZQ'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, ReP8oDsXm93lbyEPNK3.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gh8dKZJin4', 'AjAdM1VVUV', 'q40dAQbKZp', 'WoWddYluaU', 'S9edoywQ6Y', 'GOAdc4WRce', 'vc2d7Mo6pG'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, ga4LsD17sh3dIvBW0P.cs	High entropy of concatenated method names: 'euFK3AJvIK', 'gAQKn4yPFh', 'xRAKPGHQ0c', 'tO8KUbOwFD', 'CuxKlGCpuF', 'b9FKWJbYXA', 'LWBKOJwSGY', 'Nt8KadB2NL', 'CyeKNc1WHf', 'FkgK4lK80u'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, QJYhF1uiac9nFLm6lX.cs	High entropy of concatenated method names: 'P2DMpUgYNC', 'dQxMVICshR', 'qabMykibEk', 'e6BMC40k5D', 'f4VMKk3d0P', 'pRZMQs1X8o', 'Next', 'Next', 'Next', 'NextBytes'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, TXZq00FS1mocMSXYsH.cs	High entropy of concatenated method names: 'wTQExmsCwq', 'gB0EGWpg65', 'ToString', 'i2oEt6TCpb', 'c6SEvwp0Mo', 'LP6Epv9BAv', 'AfPEVXTIkk', 'xt8EyAgNmR', 'wDXECNLhmv', 'ixDEQcj4FM'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, gRsuFjIHd2KsS7oaw2.cs	High entropy of concatenated method names: 'tADV8SgBry', 'fGHVqAlww0', 'uoxpPYvMGy', 'WRYpUjJvcN', 'M0Lplud6J9', 'zbspW7HKfD', 'cwApOTenMY', 'rvtpaWTB8t', 'nUNpNWZ0Db', 'otyp42YsyN'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, Q3LnG9p2R2MHwXGks7.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 's7Wh1ElIwI', 'imvhuUsQ2X', 'RAWhzTeJbq', 'HJ1Lwy2Vuj', 'jn2LsT6CEc', 'cEXLhstItM', 'DlnLLjDkI5', 'xlM3bryX8kL8xjvJrdq'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, DZAHqGOtiyo1Bs9Aqg.cs	High entropy of concatenated method names: 'NToCtMuJci', 'fB2CpoDlRU', 'vroCy1ZOoc', 'xpIyu7yao1', 'FDTyzTDX2X', 'ptKCw4nawu', 'T9ECsMvs0w', 'LYAChwMxxX', 'ofUCLskjDh', 'eAOCXuYNCL'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, m11KElQoaGTS6ScoKL.cs	High entropy of concatenated method names: 'NjOLTaPOyj', 'TL6LtheLGW', 'TY2Lv0f7MU', 'IIFLpJVUh2', 'Bx1LVmWy9l', 'PxjLyerkmU', 'KwdLCa7TP2', 'KNPLQPyPMa', 'J1HLk9RnRg', 'CD3LxwZQFt'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, f57wJhmT7YHopwyBIw.cs	High entropy of concatenated method names: 'ToString', 'zTWjDTwTdM', 'gb1jnHdb23', 'eoljPQaFCW', 'qtYjUG9e5W', 'zjdjlWUoqp', 'bvJjWImEVo', 'NfHjOLveVS', 'NJsja1Crx0', 'awwjNOu6Wm'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, FW0hhQgAOEfCCH3hhp.cs	High entropy of concatenated method names: 'mAaf44AjMT', 'cSDfiI2kd2', 'lG6fg5KQLV', 'o5qfRJLTGC', 'lRnfnpxZhA', 'KymfPpEcPv', 'CwIfUHK9aa', 'GSkflt023Q', 'TnffWHGgPV', 'zSGfO3eLlI'
Source: 4.2.Quotation.exe.36ca900.2.raw.unpack, EH5YPs3cO4fsFQ2Gft.cs	High entropy of concatenated method names: 'dQKyTDiwwf', 'kn8yvGbmCH', 'FbWyV47XF9', 'OjSyCdeEiq', 'sjKyQEreog', 'QweVBJVIYc', 'fTAV5eoLDT', 'yoFVrSWL5s', 'l4HVea3sQ7', 'dq2V1dpHoQ'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, gnUSCu92R6bF7qGVZD.cs	High entropy of concatenated method names: 'RZBvgHWrZL', 'xlOvR7y92r', 'NT1vmu1aHi', 'gXFvF3uq5K', 'TafvBRPwMr', 'l5xv5AV5cU', 'eoRvrWsX6j', 'Aj0veL1KGO', 'DxGv1hZpCM', 'PaEvuMCsYg'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, eHT1T75IHvJ8sOUE38.cs	High entropy of concatenated method names: 'uqPEeKOPkI', 'am7EuHBoh6', 'P9jYwxEqW7', 'IL6YsGuJXR', 'cM7EDkbJ4F', 'y2PEi7xAbg', 'xgfEJr8alV', 'AHvEg7Ssvp', 'zHoEREL7AC', 'WKWEm8bM9X'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, LRZpgcvSu5EnCVpLXd.cs	High entropy of concatenated method names: 'Dispose', 'nTHs1YPDXJ', 'YcShngZIac', 'uBB0g0oNLZ', 'it3sueMDTU', 'tCvszwHlNA', 'ProcessDialogKey', 'Dfvhwa4LsD', 'xshhs3dIvB', 'K0PhhJJYhF'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, QW44ZNssmHdh1ViQKBq.cs	High entropy of concatenated method names: 'UMlMuE16JM', 'E9BMzdNXRO', 'rGhAwRq17H', 'Gw4Ask9hkv', 'oCdAhIYP8U', 'volALcxjfj', 'SRXAXUnVWi', 'S08ATEH1MK', 'YdMAtg4Hw3', 'KsdAvkMx9s'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, j8l8X3hGl6YEdJptKd.cs	High entropy of concatenated method names: 'aQ9bNUbPi', 'xne2YxFQw', 'gcUSLjEdW', 'm0FqZlYQj', 't6kHxmPOn', 'SmxIE5jlu', 'vtBQorYgb92uamuWtY', 'vLx0XoaIOkl1LbuvmQ', 'F60YCBCvT', 'lkaMEtehl'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, hSEuaEN37iorj9y7aG.cs	High entropy of concatenated method names: 'DCgC02o78d', 'IfTCZ1Jeh5', 'EsCCbnIYoY', 'Av0C26uQYx', 'k7sC8bVpvS', 'rd1CSH3WQ3', 'UiuCqnndvO', 'mMFC99o929', 'xyGCHGpXdU', 'MogCIZLFjv'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, bMPlLSJ9RqY9YkWwgi.cs	High entropy of concatenated method names: 'Ixm69MkUSq', 'oDL6HAd7EL', 'd77639gl9q', 'qtZ6nOfTwV', 'EnD6UD3LpM', 'Wcx6lvV3AB', 'C386OpvWv6', 'vHL6ayDFjl', 'nUe64kDd0m', 'DD26DmkAP5'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, WYve84rJfGTHYPDXJy.cs	High entropy of concatenated method names: 'Q87KfC9Q5J', 'tcIKEMq3ff', 'DiSKK8fJ7O', 'mprKA0VtjZ', 'rsYKob0KOb', 'OM6K7lSujQ', 'Dispose', 'AhUYtQNqQ2', 'oFfYv9yIsE', 'lbtYpomW2W'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, WTq2RLX5BngG5eQIvd.cs	High entropy of concatenated method names: 'BdpsCnUSCu', 'AR6sQbF7qG', 'egKsxywxRY', 'WhgsG3vRsu', 'xoasfw29H5', 'rPssjcO4fs', 'JfnmA6t9hWGbTPEyjA', 'fnkh9956AZ0UKogC56', 'IGwssDgf0e', 'M7csLN8Xsc'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, qn8HZVzKsW0qKGJ613.cs	High entropy of concatenated method names: 'CUBMSJRJL1', 'KfJM9WX3Td', 'r37MHf4oJk', 'v3LM3QJr3I', 'Y07Mn5Y53A', 'bmCMUOg4Rk', 'D7LMlr8SD1', 'b0tM7vgLvJ', 'x4NM0wLByi', 'dBVMZjhM4i'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, ocCpNTHgKywxRYehg3.cs	High entropy of concatenated method names: 'xQQp2aKZ7i', 'TqppSGNarO', 'sZxp9eByrx', 'FtYpHegpef', 'w9Epf7EH6W', 'fhRpjXqRiL', 'NwYpEpamqu', 'gEFpY4tgNR', 'dwnpKVYynT', 'Un6pMbURZQ'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, ReP8oDsXm93lbyEPNK3.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gh8dKZJin4', 'AjAdM1VVUV', 'q40dAQbKZp', 'WoWddYluaU', 'S9edoywQ6Y', 'GOAdc4WRce', 'vc2d7Mo6pG'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, ga4LsD17sh3dIvBW0P.cs	High entropy of concatenated method names: 'euFK3AJvIK', 'gAQKn4yPFh', 'xRAKPGHQ0c', 'tO8KUbOwFD', 'CuxKlGCpuF', 'b9FKWJbYXA', 'LWBKOJwSGY', 'Nt8KadB2NL', 'CyeKNc1WHf', 'FkgK4lK80u'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, QJYhF1uiac9nFLm6lX.cs	High entropy of concatenated method names: 'P2DMpUgYNC', 'dQxMVICshR', 'qabMykibEk', 'e6BMC40k5D', 'f4VMKk3d0P', 'pRZMQs1X8o', 'Next', 'Next', 'Next', 'NextBytes'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, TXZq00FS1mocMSXYsH.cs	High entropy of concatenated method names: 'wTQExmsCwq', 'gB0EGWpg65', 'ToString', 'i2oEt6TCpb', 'c6SEvwp0Mo', 'LP6Epv9BAv', 'AfPEVXTIkk', 'xt8EyAgNmR', 'wDXECNLhmv', 'ixDEQcj4FM'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, gRsuFjIHd2KsS7oaw2.cs	High entropy of concatenated method names: 'tADV8SgBry', 'fGHVqAlww0', 'uoxpPYvMGy', 'WRYpUjJvcN', 'M0Lplud6J9', 'zbspW7HKfD', 'cwApOTenMY', 'rvtpaWTB8t', 'nUNpNWZ0Db', 'otyp42YsyN'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, Q3LnG9p2R2MHwXGks7.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 's7Wh1ElIwI', 'imvhuUsQ2X', 'RAWhzTeJbq', 'HJ1Lwy2Vuj', 'jn2LsT6CEc', 'cEXLhstItM', 'DlnLLjDkI5', 'xlM3bryX8kL8xjvJrdq'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, DZAHqGOtiyo1Bs9Aqg.cs	High entropy of concatenated method names: 'NToCtMuJci', 'fB2CpoDlRU', 'vroCy1ZOoc', 'xpIyu7yao1', 'FDTyzTDX2X', 'ptKCw4nawu', 'T9ECsMvs0w', 'LYAChwMxxX', 'ofUCLskjDh', 'eAOCXuYNCL'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, m11KElQoaGTS6ScoKL.cs	High entropy of concatenated method names: 'NjOLTaPOyj', 'TL6LtheLGW', 'TY2Lv0f7MU', 'IIFLpJVUh2', 'Bx1LVmWy9l', 'PxjLyerkmU', 'KwdLCa7TP2', 'KNPLQPyPMa', 'J1HLk9RnRg', 'CD3LxwZQFt'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, f57wJhmT7YHopwyBIw.cs	High entropy of concatenated method names: 'ToString', 'zTWjDTwTdM', 'gb1jnHdb23', 'eoljPQaFCW', 'qtYjUG9e5W', 'zjdjlWUoqp', 'bvJjWImEVo', 'NfHjOLveVS', 'NJsja1Crx0', 'awwjNOu6Wm'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, FW0hhQgAOEfCCH3hhp.cs	High entropy of concatenated method names: 'mAaf44AjMT', 'cSDfiI2kd2', 'lG6fg5KQLV', 'o5qfRJLTGC', 'lRnfnpxZhA', 'KymfPpEcPv', 'CwIfUHK9aa', 'GSkflt023Q', 'TnffWHGgPV', 'zSGfO3eLlI'
Source: 4.2.Quotation.exe.83a0000.5.raw.unpack, EH5YPs3cO4fsFQ2Gft.cs	High entropy of concatenated method names: 'dQKyTDiwwf', 'kn8yvGbmCH', 'FbWyV47XF9', 'OjSyCdeEiq', 'sjKyQEreog', 'QweVBJVIYc', 'fTAV5eoLDT', 'yoFVrSWL5s', 'l4HVea3sQ7', 'dq2V1dpHoQ'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Quotation.exe PID: 6536, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Quotation.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 2230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 2430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 4430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 8520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 9520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 9720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: A720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 10B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 2B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 28C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6503	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3147	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Window / User API: threadDelayed 2477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Window / User API: threadDelayed 7361	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe TID: 1004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7340	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7604	Thread sleep count: 2477 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7604	Thread sleep count: 7361 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -99563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -98139s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -97914s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -97435s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -97272s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -97126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -96719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -96406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -96176s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -96047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -95937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -95827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -95718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -95609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -95500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -95391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -95266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -95155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -95047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -94937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -94828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -94719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -94609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -94499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -94390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -94281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -94172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -94062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -93950s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -93844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -93733s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 7616	Thread sleep time: -93617s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99563	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98139	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97914	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97435	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97272	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97126	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96719	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96406	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96176	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96047	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 95937	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 95827	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 95718	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 95609	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 95500	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 95391	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 95266	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 95155	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 95047	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 94937	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 94719	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 94609	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 94499	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 94390	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 94281	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 94172	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 94062	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 93950	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 93844	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 93733	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 93617	Jump to behavior

Source: Quotation.exe, 0000000D.00000002.3736627161.0000000000E15000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Quotation.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe"
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Quotation.exe

Memory written: C:\Users\user\Desktop\Quotation.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Users\user\Desktop\Quotation.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Users\user\Desktop\Quotation.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.2.Quotation.exe.364b6e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Quotation.exe.3686100.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Quotation.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Quotation.exe.3686100.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Quotation.exe.364b6e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3738165227.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3738165227.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 1792, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Quotation.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Quotation.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 4.2.Quotation.exe.364b6e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Quotation.exe.3686100.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Quotation.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Quotation.exe.3686100.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Quotation.exe.364b6e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3738165227.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 1792, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.2.Quotation.exe.364b6e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Quotation.exe.3686100.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Quotation.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Quotation.exe.3686100.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Quotation.exe.364b6e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3738165227.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3738165227.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 1792, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Quotation.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.Genie8DN
Quotation.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://mail.showpiece.trillennium.biz	0%	Avira URL Cloud	safe
http://showpiece.trillennium.biz	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.ipify.org	104.26.13.205	true	false	high
showpiece.trillennium.biz	67.23.226.139	true	true	unknown
mail.showpiece.trillennium.biz	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://showpiece.trillennium.biz	Quotation.exe, 0000000D.00000002.3738165227.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	Quotation.exe, 00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 0000000D.00000002.3738165227.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://account.dyn.com/	Quotation.exe, 00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://mail.showpiece.trillennium.biz	Quotation.exe, 0000000D.00000002.3738165227.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Quotation.exe, 00000004.00000002.1292437166.00000000024A5000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 0000000D.00000002.3738165227.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources	Quotation.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
67.23.226.139	showpiece.trillennium.biz	United States		33182	DIMENOCUS	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558498
Start date and time:	2024-11-19 14:29:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Quotation.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/6@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 163 Number of non-executed functions: 15
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Quotation.exe

Simulations

Behavior and APIs

Time	Type	Description
08:30:53	API Interceptor	8870001x Sleep call for process: Quotation.exe modified
08:30:55	API Interceptor	14x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.23.226.139	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	3Pd480eWHA.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	COTIZACION.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Quotation.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Revised PI 28 08 2024.exe	Get hash	malicious	AgentTesla	Browse
	PI 22_8_2024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	COTIZACION 19 08 24.exe	Get hash	malicious	AgentTesla	Browse
104.26.13.205	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	DOCS.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	1Sj5F6P4nv.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	5LEXIucyEP.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	44qLDKzsfO.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	gP5rh6fa0S.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	spacers.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	urkOkB0BdX.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	8F0oMWUhg7.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	[Inquiry] mv Palmela - CE replacement at your port, oa Nov. 22nd.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	d29z3fwo37.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	Review_&_Aprove_Your_Next_Payment76770.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
	payload_1.ps1	Get hash	malicious	Unknown	Browse	172.67.207.199
	FjMBwo1meU.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	qupybikrqX.doc	Get hash	malicious	Unknown	Browse	104.21.90.242
	https://dorentop.es/yorii/Odrivex/	Get hash	malicious	Unknown	Browse	172.67.133.148
	hmjsOnyfSB.dll	Get hash	malicious	LummaC	Browse	172.67.184.174
	FjMBwo1meU.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	qupybikrqX.doc	Get hash	malicious	Unknown	Browse	104.21.90.242
DIMENOCUS	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	67.23.226.139
	hiss.mpsl.elf	Get hash	malicious	Unknown	Browse	198.136.58.114
	Updated Document-9875488675.pdf	Get hash	malicious	Captcha Phish	Browse	67.23.254.53
	3Pd480eWHA.exe	Get hash	malicious	AgentTesla	Browse	67.23.226.139
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	67.23.226.139
	COTIZACION.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	67.23.226.139
	Quotation.exe	Get hash	malicious	AgentTesla	Browse	67.23.226.139
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	67.23.226.139
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	67.23.226.139
	https://lumen.backerkit.com/invites/mAqpu6B5ZtIAsrg4a5WdGA/confirm?redirect_path=//rahul-garg-lcatterton-com.athuselevadores.com.br	Get hash	malicious	HTMLPhisher	Browse	107.161.183.172

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//MPUyus:lGLHyIFKL3IZ2KRH9Ougss
MD5:	C961E3496AA47D8AF3F9E184D4F78133
SHA1:	0EFEA67BD361E99BBE642D6EF414EBE7BB6EC134
SHA-256:	303E0E36CAC4900807E47B6AF8CDAB4FBFDB6A67D66F84F49E283557EA1774B1
SHA-512:	C3ECDCCF25D96C4F0C7B6407C8BAA7A0496C656C63E4757982FA1A754AF5B7902F3318F0AFE1363F365714584869A5E1E754692A84D814DD9EFDEB909A3104A3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_35nan4xm.0aj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_seuynxxz.qqt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_umfec4jx.yhu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2huboqp.ffk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.937358030826137
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Quotation.exe
File size:	670'208 bytes
MD5:	404a7ca256047297656926bbea03415f
SHA1:	de02afb6d97f497ddaa0025a358b501a1ee942e4
SHA256:	f03acdb2a846f8060d76c3d81651949b5699a5dee5b2b26ec238872defd12252
SHA512:	1c14b08ae8e339936dbaed751e979d2e376d05602ffdc80411d46a0d630b167be071ee9dadf6c478c91cad37441222b196952dffe7f35111d13113ad2a5a3ee1
SSDEEP:	12288:c1o7Me/hO6Umv8qUYV/WxdN2LeszNZomchu2/9OOo8fQRI7V6di1NM2B:Ao7ZhO5mv845veaomtk9Ocf7iAD
TLSH:	D6E412A562ACCBAAE1BD4BF69465605023F171BA7931F25D8FD320ED097BF404B21E07
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=b<g..............0..............M... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4a4d06
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673C623D [Tue Nov 19 10:02:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa4cb3	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa6000	0x64c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa2bb0	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa2d0c	0xa2e00	359d3ddc55eac23204760edd8572df1e	False	0.9555248105333844	data	7.945855715131603	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa6000	0x64c	0x800	fc5d7f5be0f12f81aee8985d3b766154	False	0.3408203125	data	3.5066612303843345	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa8000	0xc	0x200	30ac7090a8d7bd799dcec0ece7385255	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa6090	0x3bc	data			0.4131799163179916
RT_MANIFEST	0xa645c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 14:30:56.549623966 CET	49702	443	192.168.2.7	104.26.13.205
Nov 19, 2024 14:30:56.549763918 CET	443	49702	104.26.13.205	192.168.2.7
Nov 19, 2024 14:30:56.549899101 CET	49702	443	192.168.2.7	104.26.13.205
Nov 19, 2024 14:30:56.597412109 CET	49702	443	192.168.2.7	104.26.13.205
Nov 19, 2024 14:30:56.597459078 CET	443	49702	104.26.13.205	192.168.2.7
Nov 19, 2024 14:31:06.622030020 CET	49702	443	192.168.2.7	104.26.13.205
Nov 19, 2024 14:31:06.663348913 CET	443	49702	104.26.13.205	192.168.2.7
Nov 19, 2024 14:31:07.942030907 CET	49706	587	192.168.2.7	67.23.226.139
Nov 19, 2024 14:31:08.946415901 CET	49706	587	192.168.2.7	67.23.226.139
Nov 19, 2024 14:31:10.951796055 CET	49706	587	192.168.2.7	67.23.226.139
Nov 19, 2024 14:31:14.951776028 CET	49706	587	192.168.2.7	67.23.226.139
Nov 19, 2024 14:31:22.951854944 CET	49706	587	192.168.2.7	67.23.226.139
Nov 19, 2024 14:33:06.687391996 CET	49702	443	192.168.2.7	104.26.13.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 14:30:56.528702974 CET	58581	53	192.168.2.7	1.1.1.1
Nov 19, 2024 14:30:56.536036968 CET	53	58581	1.1.1.1	192.168.2.7
Nov 19, 2024 14:31:07.271276951 CET	49419	53	192.168.2.7	1.1.1.1
Nov 19, 2024 14:31:07.940645933 CET	53	49419	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 14:30:56.528702974 CET	192.168.2.7	1.1.1.1	0x5e24	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:31:07.271276951 CET	192.168.2.7	1.1.1.1	0xbf72	Standard query (0)	mail.showpiece.trillennium.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 14:30:56.536036968 CET	1.1.1.1	192.168.2.7	0x5e24	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:30:56.536036968 CET	1.1.1.1	192.168.2.7	0x5e24	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:30:56.536036968 CET	1.1.1.1	192.168.2.7	0x5e24	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:31:07.940645933 CET	1.1.1.1	192.168.2.7	0xbf72	No error (0)	mail.showpiece.trillennium.biz	showpiece.trillennium.biz		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:31:07.940645933 CET	1.1.1.1	192.168.2.7	0xbf72	No error (0)	showpiece.trillennium.biz		67.23.226.139	A (IP address)	IN (0x0001)	false

Target ID:	4
Start time:	08:30:53
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\Quotation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quotation.exe"
Imagebase:	0x50000
File size:	670'208 bytes
MD5 hash:	404A7CA256047297656926BBEA03415F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.1294433791.0000000003439000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:30:54
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quotation.exe"
Imagebase:	0x6e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:30:54
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\Quotation.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Quotation.exe"
Imagebase:	0x7ff7b4ee0000
File size:	670'208 bytes
MD5 hash:	404A7CA256047297656926BBEA03415F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:30:54
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:30:54
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\Quotation.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Quotation.exe"
Imagebase:	0x200000
File size:	670'208 bytes
MD5 hash:	404A7CA256047297656926BBEA03415F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:30:54
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\Quotation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quotation.exe"
Imagebase:	0x6c0000
File size:	670'208 bytes
MD5 hash:	404A7CA256047297656926BBEA03415F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.3738165227.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.3738165227.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.3738165227.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.3734092750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:30:56
Start date:	19/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7fb730000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	131
Total number of Limit Nodes:	6

Executed Functions

Function 06A034B8 Relevance: 5.6, Strings: 4, Instructions: 562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 06A03874
~, xrefs: 06A036D6
:, xrefs: 06A03737
pq, xrefs: 06A0393D

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: 4'q$:$pq$~
API String ID: 0-4038137657
Opcode ID: 6fc42037eafedcc5b19e7018c22138e18d46b6214710a03e7d66ea733366fa01
Instruction ID: f3d668552bb2a24ea0c1876a031c01d49b34890f6ef9f699f593f8f7ad32d659
Opcode Fuzzy Hash: 6fc42037eafedcc5b19e7018c22138e18d46b6214710a03e7d66ea733366fa01
Instruction Fuzzy Hash: 9842F275E00218DFEB55DFA9D980B99BBB2FF88300F1580E9E509AB261D731AD91CF50

Function 06A02106 Relevance: 1.8, Strings: 1, Instructions: 562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 06A0210B

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 2c5085888ede12ee2867bc087a707ed7d30ee359ec98c853a25eadb287893fee
Instruction ID: de1805f8957cd03bb3061edb3e9079ce94e4cfb3b49f5c7b185bbeffee3c3a2e
Opcode Fuzzy Hash: 2c5085888ede12ee2867bc087a707ed7d30ee359ec98c853a25eadb287893fee
Instruction Fuzzy Hash: E852A674A012298FDB64DF64D998B9DB7B2FF89301F1081E9D50AA7365CB34AE81CF50

Function 0227A3F0 Relevance: .7, Instructions: 662COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1291933981.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2270000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d3e1269bbd25e28be074cc6b3abb2ee38c0ca08aa748828f4769fbd1818681
Instruction ID: 1c013bcd846932adbc4fc856272df789a04305f00c007ed7ea63e1fe2f5a2a7c
Opcode Fuzzy Hash: a1d3e1269bbd25e28be074cc6b3abb2ee38c0ca08aa748828f4769fbd1818681
Instruction Fuzzy Hash: B842F030A147168FCB15CFA8C880AAEB7F6FF45320B058969D856DB299D730FD95CB90

Function 06B448A0 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3916697390288debcfe22be826294cb444068ef3441908691086c44d827b5c6
Instruction ID: 81e5db3ea6cf01dfce16237e3d8e45df58c66da6f0bc702ac2bcfeadfa967b50
Opcode Fuzzy Hash: c3916697390288debcfe22be826294cb444068ef3441908691086c44d827b5c6
Instruction Fuzzy Hash: D6E1CBB0B017048FDB65EBB9C560BAEB7FBEF89701F1444A9D14A9B290CB35E801DB50

Function 06A0BCB8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c0f470f4eb82bff7bd1ccf691c84c076d74a2dbb49252b9cb13463bce879e3
Instruction ID: af84296a0cbff5e2656305e4135e4b8b7e3addbfc6cb1f334f45cdb0223caff0
Opcode Fuzzy Hash: b9c0f470f4eb82bff7bd1ccf691c84c076d74a2dbb49252b9cb13463bce879e3
Instruction Fuzzy Hash: 2921E5B1D046589FEB18CFA7D8447DEFFF6AF89300F04C16AD409AA294DB7509468FA1

Function 06A02C38 Relevance: 7.9, Strings: 6, Instructions: 443
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 06A02CDE
4|q, xrefs: 06A02E43
4|q, xrefs: 06A02E28
4'q, xrefs: 06A02CAE
$q, xrefs: 06A02D00
4'q, xrefs: 06A02C53

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4|q$4|q$$q
API String ID: 0-3102600102
Opcode ID: a8297ebe2e9ca958bd76392e54ab6cb3c255541a5eca3f484d9a4696917ec713
Instruction ID: dd8709c91ee6e58cd16d7256e2ecc365bfe366aa7c0e1399f92f35b8c44203e7
Opcode Fuzzy Hash: a8297ebe2e9ca958bd76392e54ab6cb3c255541a5eca3f484d9a4696917ec713
Instruction Fuzzy Hash: 27E1BC30F042198FEB59EF79E85866E7BF6EF89301B194469E406DB3A1DA34CD01CB90

Function 0227CFF1 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0227D07E
GetCurrentThread.KERNEL32 ref: 0227D0BB
GetCurrentProcess.KERNEL32 ref: 0227D0F8
GetCurrentThreadId.KERNEL32 ref: 0227D151

Memory Dump Source

Source File: 00000004.00000002.1291933981.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2270000_Quotation.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 250eae90d8961a7d4b808a621f0972c28fc310b3a7f742aaf719981edcab95eb
Instruction ID: 06623b13f6a0a27b90f4b045fc268a15860e73bf3e134102ebe81020d291fe5a
Opcode Fuzzy Hash: 250eae90d8961a7d4b808a621f0972c28fc310b3a7f742aaf719981edcab95eb
Instruction Fuzzy Hash: 765167B0D003498FEB14DFAAD549B9EBBF1EF88314F208459E419A73A0DB345945CF65

Function 0227D000 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0227D07E
GetCurrentThread.KERNEL32 ref: 0227D0BB
GetCurrentProcess.KERNEL32 ref: 0227D0F8
GetCurrentThreadId.KERNEL32 ref: 0227D151

Memory Dump Source

Source File: 00000004.00000002.1291933981.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2270000_Quotation.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ebfbef37302cff7a21e6efc3d11188456f90dd0bbd38961864ed29f06b4c77ba
Instruction ID: 7e750f37b362269ee0910523e712ec0bc47208f5c43124f2fd60c28b29e00ad6
Opcode Fuzzy Hash: ebfbef37302cff7a21e6efc3d11188456f90dd0bbd38961864ed29f06b4c77ba
Instruction Fuzzy Hash: 015187B0D003098FEB14DFAAD549B9EBBF1EF88314F208459E419A73A0CB346945CF65

Function 06B41164 Relevance: 1.7, APIs: 1, Instructions: 244
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06B413A6

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a34e1322683ff4ebaa56f9627c3406c2a4abafe164b505070b5ec74c2f3d721d
Instruction ID: 01f5c7b66ade689e95ea15f9aff8ac51e59403847f0a2f403487c9b8ddac8014
Opcode Fuzzy Hash: a34e1322683ff4ebaa56f9627c3406c2a4abafe164b505070b5ec74c2f3d721d
Instruction Fuzzy Hash: C9915AB1D007198FEB64DFA8C840BEDBBB2FB49314F1485A9E808E7240DB759985DF91

Function 06B41170 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06B413A6

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c723c81fef1262da8fc50dffadab2ff665959ae0b2973c679190a8cb0c43d175
Instruction ID: f0e5e6dbc31deddaa320f15189f21f5b9f86cfc0e5eca6d93d3dfd6aedda20d0
Opcode Fuzzy Hash: c723c81fef1262da8fc50dffadab2ff665959ae0b2973c679190a8cb0c43d175
Instruction Fuzzy Hash: 8F915AB1D007198FEB64DFA8C840BEDBBB2FB49314F1485A9E808E7240DB759985DF91

Function 0227AD68 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0227AFBE

Memory Dump Source

Source File: 00000004.00000002.1291933981.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2270000_Quotation.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6bad089439012b3d336336695fd163544d8bf0da6c0aa1e07b76bb24cad1ccbd
Instruction ID: 7d3950abb41389ae4cd5b6480d4ded1722b303cd6af788530e2f518d1a6599ca
Opcode Fuzzy Hash: 6bad089439012b3d336336695fd163544d8bf0da6c0aa1e07b76bb24cad1ccbd
Instruction Fuzzy Hash: 5F716770A14B068FD724DFAAD44075ABBF1FF88314F008A2DD48ADBA54DB75E809CB95

Function 0227590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 022759C9

Memory Dump Source

Source File: 00000004.00000002.1291933981.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2270000_Quotation.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0db48929f2d801f1985f154be40e27df97cae76b8ff14d3f67d854411db50295
Instruction ID: acade4fa4275aad28b3831dc118eb2349f59c919bf9f71bdf6c236460fdb69ad
Opcode Fuzzy Hash: 0db48929f2d801f1985f154be40e27df97cae76b8ff14d3f67d854411db50295
Instruction Fuzzy Hash: 6541F271C00719CBEB24DFAAC88578EFBF5BF49304F60816AD408AB255DB756946CF90

Function 022744B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 022759C9

Memory Dump Source

Source File: 00000004.00000002.1291933981.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2270000_Quotation.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 06c685574ee6765e8d6883e1fc78c52cfcffc4d3e5b5b7866d268ce9616a61b4
Instruction ID: 67a15e9a9ad1ea2878a6febe173872422e547739360da21a7c26a50441dda750
Opcode Fuzzy Hash: 06c685574ee6765e8d6883e1fc78c52cfcffc4d3e5b5b7866d268ce9616a61b4
Instruction Fuzzy Hash: 5241E171C14719CBEB24DFAAC84578EFBB5BF48304F60806AD408AB255DB756946CF90

Function 06B40EE0 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06B40F78

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ce8c35176d10ec7fe8dcfdec17dd31270942ebf4eedbe90d7c6c22836025f041
Instruction ID: b854d06dc6d94df78e64fb9a411e577d65da118cc565dd8bf7cb56a77cef5bbd
Opcode Fuzzy Hash: ce8c35176d10ec7fe8dcfdec17dd31270942ebf4eedbe90d7c6c22836025f041
Instruction Fuzzy Hash: E7214B75D013099FDB10DFA9C885BDEBBF1FF48310F50842AE959A7240D7789941DBA4

Function 06B40EE8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06B40F78

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b53d2b299c1d96db8d723a3236ace2576391ace52903cf79a2b07d424f1f117a
Instruction ID: 2c3ecac998733b07fcc16127325b08ee0aec9c1168f9623aee4b4a173401a5e8
Opcode Fuzzy Hash: b53d2b299c1d96db8d723a3236ace2576391ace52903cf79a2b07d424f1f117a
Instruction Fuzzy Hash: 8E2127B5D013099FDB10DFAAC881BDEBBF5FF48310F508429E918A7240C7799941DBA5

Function 0227D648 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0227D6D7

Memory Dump Source

Source File: 00000004.00000002.1291933981.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2270000_Quotation.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: db50a689c02c7a09666f3a7bf94f5669f22dad599036e24dbff7df0d58fbc7fd
Instruction ID: c09a2f18ae20defb3e34d946ccf473a9896243ff2ed9b4584b3fb33e07a755bd
Opcode Fuzzy Hash: db50a689c02c7a09666f3a7bf94f5669f22dad599036e24dbff7df0d58fbc7fd
Instruction Fuzzy Hash: 9E21E6B5D012099FDB10CF9AD984ADEBBF5FF48310F14841AE918A7350D379A941CFA4

Function 06B40911 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06B40996

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ccf5872b163c1e57d719a4a9fb218207482ae7e3145792af7cd99b1b9236532e
Instruction ID: 8ed6211649e9ed6537dcebc3d5ac1954ec9e76095d22e685f53e5a38869b686f
Opcode Fuzzy Hash: ccf5872b163c1e57d719a4a9fb218207482ae7e3145792af7cd99b1b9236532e
Instruction Fuzzy Hash: 5A213AB1D003098FDB10DFAAC4857EEBBF4EF48310F548429D559A7241CB79A945CFA5

Function 06B40FD1 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06B41058

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e9ad8d3a6b64bb344268213383b030d72cf020dbe761c07a13455563f35b2b0e
Instruction ID: 1279ea4ed50b3a37a9e8d057b0efebc23bc7185d4d78c8393419096ba083a803
Opcode Fuzzy Hash: e9ad8d3a6b64bb344268213383b030d72cf020dbe761c07a13455563f35b2b0e
Instruction Fuzzy Hash: A22125B5C003498FDB10DFA9C980BEEBBB1FF48310F50882AE529A3250C7799941DBA0

Function 06B40FD8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06B41058

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d635489055bbb558d034ccff0765891087569b53865d03365308f3d09e05135c
Instruction ID: 90b0aa6953c901be331883ecba6ab40f35c5ccc1c0a51e84cc2bf66ffa5d9fd1
Opcode Fuzzy Hash: d635489055bbb558d034ccff0765891087569b53865d03365308f3d09e05135c
Instruction Fuzzy Hash: F821F8B1D013499FDB10DFAAC841BEEBBF5FF48310F508429E919A7240C7799951DBA4

Function 06B40918 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06B40996

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 58459cf251b68340df36cef49ccb2ebcc9fa0458cc160dca5891c43458cf8b82
Instruction ID: d972bbdc8081b34608e05c3f6a7fa5edae157dcf46a1a55bc75720312cd88234
Opcode Fuzzy Hash: 58459cf251b68340df36cef49ccb2ebcc9fa0458cc160dca5891c43458cf8b82
Instruction Fuzzy Hash: 542138B1D003098FDB10EFAAC4857AEBBF4EF48310F548429D559A7241CB79A945CFA4

Function 0227D650 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0227D6D7

Memory Dump Source

Source File: 00000004.00000002.1291933981.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2270000_Quotation.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 884823fde156f9129e34977d7fd037cfda9d5685ebbac5e8560b0cbd88fa1fed
Instruction ID: a4dabdaccedbf74dcce4f2ba3e8e674abe6ae2e221000b852d0da3cf29baadc7
Opcode Fuzzy Hash: 884823fde156f9129e34977d7fd037cfda9d5685ebbac5e8560b0cbd88fa1fed
Instruction Fuzzy Hash: 8C21E4B5D002099FDB10CFAAD984ADEBBF8FB48310F14841AE918A3350D379A940CFA4

Function 06A04FDF Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

@, xrefs: 06A05107

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ddd956e6ed2ee04d1aa2ccdd72147d9b29031c2b2dfbfa2a6be8217b8d9fa1a4
Instruction ID: 7a6ded220985af1ffe8818e37f257b81390593518d4d1ee71652f5e902f406a2
Opcode Fuzzy Hash: ddd956e6ed2ee04d1aa2ccdd72147d9b29031c2b2dfbfa2a6be8217b8d9fa1a4
Instruction Fuzzy Hash: AAE18074E042188FEB50DFA9D980A9DBBF1FB49314F2481AAD858EB345D731AE85CF50

Function 06B40E20 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06B40E96

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a0c5a0d3d0c3e8ade832aecbeee1050ad79ff8481a3655fd0e372359f38c3e44
Instruction ID: 89913d598e4e36a9374dde9c56fdb1b4a80900d1fb5f99a005e0bbece5840201
Opcode Fuzzy Hash: a0c5a0d3d0c3e8ade832aecbeee1050ad79ff8481a3655fd0e372359f38c3e44
Instruction Fuzzy Hash: 6F114772D003499FDB20EFAAC845BDEBBF5EB48310F208819E525A7250CB75A941DFA4

Function 06B40E28 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06B40E96

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 49fe149408b21fdd042b882990cd2c2fc9160392b18194d1d38cccaf05098c03
Instruction ID: a0bcccd8e2eb568b7c57a560696494c00cc789da3e7a0621ff7fa9691ad04b6b
Opcode Fuzzy Hash: 49fe149408b21fdd042b882990cd2c2fc9160392b18194d1d38cccaf05098c03
Instruction Fuzzy Hash: F7112972C003499FDB20DFAAC845BDEBBF5EB48310F148819E515A7250C775A551DFA4

Function 06B40860 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0C069B2A), ref: 06B408CA

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: fa2342eac9f31022f379370e8ed7f645cc381144bd41dc0c581ae35b63df52af
Instruction ID: 27702dde1ab370690e94598fe06c01b8df752f77e85dfa154167e5f3215a200a
Opcode Fuzzy Hash: fa2342eac9f31022f379370e8ed7f645cc381144bd41dc0c581ae35b63df52af
Instruction Fuzzy Hash: 011158B1D003498FDB20EFAAC5457AEFBF4EB48320F248819D519A7640CB796540CFA4

Function 06B40868 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0C069B2A), ref: 06B408CA

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6b6e48b761afe0930fe996e7d0cec148c3fcccd8606bc1e4b491c6ae99dcad61
Instruction ID: 4c2ff77226b286c2b551f96e89a46083daae34a5f6c01adc81feb4300682a334
Opcode Fuzzy Hash: 6b6e48b761afe0930fe996e7d0cec148c3fcccd8606bc1e4b491c6ae99dcad61
Instruction Fuzzy Hash: 01113AB1D003498FDB20EFAAC44579EFBF5EB48320F248829D519A7240CB796945CF94

Function 0227AF58 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0227AFBE

Memory Dump Source

Source File: 00000004.00000002.1291933981.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2270000_Quotation.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 22ddd3594291ca7991255aa8ff94a1ffb565fb71ed88af0793359c72e69e045c
Instruction ID: 1d4da18d04d37d64b42cf5eaa269580960dd5eeda6ff3fb8bd4b18cba1876750
Opcode Fuzzy Hash: 22ddd3594291ca7991255aa8ff94a1ffb565fb71ed88af0793359c72e69e045c
Instruction Fuzzy Hash: E91110B6C043498FCB20DF9AD444BDEFBF4EB88324F10842AD429A7614C77AA545CFA5

Function 06B43B30 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 06B43B95

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5dda2fc1567b54cf03991ad17448e456c1524f8041753c8c04b86e8d1248c44b
Instruction ID: 17938002a2264fbd3d4bc0637ed6f77a2b35e4ccb326c1573ff55e9a6c0cc14f
Opcode Fuzzy Hash: 5dda2fc1567b54cf03991ad17448e456c1524f8041753c8c04b86e8d1248c44b
Instruction Fuzzy Hash: A21103B6C00649CFDB10EF9AD985BDEBBF4EB48310F14881AD568A7650C375A944CFA1

Function 06B43B38 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 06B43B95

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7106607febca0f3a264f1db723295443961f8d09ab17d42a0ff0c0d1a224f37b
Instruction ID: 763ca038d5a98cf8426d609383edc1e6d92a9641e27c45ba2e75618f71a32004
Opcode Fuzzy Hash: 7106607febca0f3a264f1db723295443961f8d09ab17d42a0ff0c0d1a224f37b
Instruction Fuzzy Hash: 5B11D3B58007499FDB10DF9AD885BDEBBF8EB48320F148859D518A7240C375A944CFA5

Function 06A03D9E Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

LRq, xrefs: 06A03E1A

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 3178fee2d420f3009daf7138d3dd650c2080e0de59b5b24132f9e3ed89bc13d4
Instruction ID: 580c2c6578a85dcd552d2ac1b94d76097c7b8c52729efb94eeab3c0257b7c14c
Opcode Fuzzy Hash: 3178fee2d420f3009daf7138d3dd650c2080e0de59b5b24132f9e3ed89bc13d4
Instruction Fuzzy Hash: E191E574E04209DFEB44DFA9D4806ADBBF6EF89314F20856AD819EB385E7359902CF40

Function 06A04894 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

Teq, xrefs: 06A05C51

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: dd1086aa36531f23efb083fa3ae6f21fbd2ad0737ca5373dbaf387740cdb0f96
Instruction ID: e0394a4e933cc8e73ef589c681f0d266de50847e24383d63b010705539672620
Opcode Fuzzy Hash: dd1086aa36531f23efb083fa3ae6f21fbd2ad0737ca5373dbaf387740cdb0f96
Instruction Fuzzy Hash: 9A51E030F002058FDB15EB79E84896FBBF6EFC5320715896AE429DB391DB309C068B90

Function 06A04428 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

8q, xrefs: 06A044C9

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-4083045702
Opcode ID: 538818580da50b58da64c3d7a612b0664ee3057cc5617f1a3812afb709a9b5f9
Instruction ID: bfca61f59414754614a80882ed5e2c351a3ef7a650126339cbb67b51e1648e76
Opcode Fuzzy Hash: 538818580da50b58da64c3d7a612b0664ee3057cc5617f1a3812afb709a9b5f9
Instruction Fuzzy Hash: FC41FC74E00108DFEB45DFA9E4546AEBBF1FB89304F108069E915A7394D731AD42CF50

Function 06A04417 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

8q, xrefs: 06A044C9

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-4083045702
Opcode ID: d0c6851145205421e47f6d9d9cb4c197e78da2698ca1b5d8c4c1437e488b32cd
Instruction ID: 4b1273762d322c6cc513f780c9d028b4fae1c33f1cdc0d37f9c53b1ac3d510ad
Opcode Fuzzy Hash: d0c6851145205421e47f6d9d9cb4c197e78da2698ca1b5d8c4c1437e488b32cd
Instruction Fuzzy Hash: 1A414E74E00208DFEB45EFA8E4546AEBBF2FB89304F108069E915AB391D731AD42CF50

Function 06A0AC7A Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

Teq, xrefs: 06A0ADB3

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: d5ebad273fe662f7a7115996947192adc67bd2d5890e30007a25847a628f3826
Instruction ID: 7616fd252d53d1f5fb62a3fb57a2d4935cafb49fcaa9530545d22fd784f1a843
Opcode Fuzzy Hash: d5ebad273fe662f7a7115996947192adc67bd2d5890e30007a25847a628f3826
Instruction Fuzzy Hash: 49311874E043588FEB44DFA6D8446EEBBF6EF89300F14902AD519AB395DB745906CF80

Function 06A0ACF2 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Teq, xrefs: 06A0AD1C

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 37e06f3894d267b4f7165dc716e03b903fba059a3ce291cbcd42412b8356109d
Instruction ID: 4757bd09e985f407a7f9928b98f3a5260be30b22c69ab8735a6cf7d8fc282038
Opcode Fuzzy Hash: 37e06f3894d267b4f7165dc716e03b903fba059a3ce291cbcd42412b8356109d
Instruction Fuzzy Hash: 4831B174E04219CFEB44DFE9E884AADBBB2FF88310F14812AE919AB261D7345941CB50

Function 06A0AC88 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

Teq, xrefs: 06A0ADB3

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 06f6dfe7a3d5d138026822b40e9dd96cea6e51b6769724b6de25f304edd98673
Instruction ID: d2af46efe663643bce4766b825a193d0f22bd78f1f055f27664cca128a01b467
Opcode Fuzzy Hash: 06f6dfe7a3d5d138026822b40e9dd96cea6e51b6769724b6de25f304edd98673
Instruction Fuzzy Hash: 2D31F6B4E043588FEB44DFA6D8447AEBBF6EF89300F109029D919AB395DB745846CF80

Function 06A05608 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Teq, xrefs: 06A05673

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 417d6bcf81c79be91ddc95ff1554a02495d7a2cd6fb7d515ee5eaea8350401ae
Instruction ID: 50ebd0c84fb1e0c4a59154666f33e26fd42f94baefd982b35e238734533209b0
Opcode Fuzzy Hash: 417d6bcf81c79be91ddc95ff1554a02495d7a2cd6fb7d515ee5eaea8350401ae
Instruction Fuzzy Hash: 74111271F002198BEB54FBB9A9116EE76F6AB88311F144079C514EB384EF318D01CBD5

Function 06A0AD8F Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

Teq, xrefs: 06A0AD1C

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: b8f91d5d96aa545cfe02ae0b8ed43977789d45490dffb71fd03d01a70bf30da5
Instruction ID: 8b26afbe4a0beb9a858c540e4f69d359a3dedcb2759a873301490a7e0bd08aea
Opcode Fuzzy Hash: b8f91d5d96aa545cfe02ae0b8ed43977789d45490dffb71fd03d01a70bf30da5
Instruction Fuzzy Hash: BD11AF75E04209CFDB08DFE9D8849ADFBB2FB88300F10812AEA19AB365C7355955CF50

Function 06A0AD0A Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

Teq, xrefs: 06A0AD1C

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 7e698a329c6ceaa2a0e1c2043701d054f5ac5a9416d8fe2260719f896a8cbec6
Instruction ID: 511c3c8e736019556e761d912a870c739e849b595e7b2db80754497f62ed3598
Opcode Fuzzy Hash: 7e698a329c6ceaa2a0e1c2043701d054f5ac5a9416d8fe2260719f896a8cbec6
Instruction Fuzzy Hash: 96119F75E00209DFDB08DFE8D8849ADFBB2FB88314F10812AEA19AB365C7315955CF50

Function 06A07EF9 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

;, xrefs: 06A07F1C

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: 57ef3a7548e544d0360425ddd89dd53aa10520db8311ebfcc3a80ba87afbd1e3
Instruction ID: b86f174e90250219ad4fe41100820372e7fa9be4f05c4a75bb2ad9ebbaa1ea83
Opcode Fuzzy Hash: 57ef3a7548e544d0360425ddd89dd53aa10520db8311ebfcc3a80ba87afbd1e3
Instruction Fuzzy Hash: 48018B70E05209AFEB51EFA4E8446AEBBB8EF06340F1045A6D805DB3C0E7349E15CBD1

Function 06A07450 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

m, xrefs: 06A07464

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 2412db93423390a7665e508a10ca019ae0679f46b94bffcabc590c0acaf3bd09
Instruction ID: 30f328000c5530bd84972e2b54ee0c2f07e2a4382e1cd954290240b88ab1eb42
Opcode Fuzzy Hash: 2412db93423390a7665e508a10ca019ae0679f46b94bffcabc590c0acaf3bd09
Instruction Fuzzy Hash: EAE08C30E04208BBEB44FBA4A44466D7AB89B01301F400194C40557280D632AE54CAA1

Function 06A03348 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

6, xrefs: 06A0335C

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: 8caa698e96184d9ed69a8ca08a28e5c277d474181e269d1ca7d2b85bcae9c70a
Instruction ID: 77f33817adfb4475ff301b31f325d089318ffd9819a24820f450b5be9135d707
Opcode Fuzzy Hash: 8caa698e96184d9ed69a8ca08a28e5c277d474181e269d1ca7d2b85bcae9c70a
Instruction Fuzzy Hash: D9E08C70D0420CEBEF24EFA4E48826DBBB8E70A301F504195C80693280EB314E54D682

Function 06A04038 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

7, xrefs: 06A0404C

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: a33438b1c1638e600fd34e242cb68878218ecf5491741b53603ef997c0e1e092
Instruction ID: b2175d512e871e321e1c357e35a89079c4ff406c988b8dd1402f6044d2897d37
Opcode Fuzzy Hash: a33438b1c1638e600fd34e242cb68878218ecf5491741b53603ef997c0e1e092
Instruction Fuzzy Hash: 8BE08C70D0920CEBFB50FFA4B80466D76F8E749300F4001A4C50667680D6390E44C681

Function 06A0AEB0 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672179b22ae45f7f4ca20ec42b2917063faa4cf1e89f6dd95c1fcd3147711249
Instruction ID: 30403f0cfddb9238bdd7d794a39cf280db7492f40f33bc103f358fec43e786de
Opcode Fuzzy Hash: 672179b22ae45f7f4ca20ec42b2917063faa4cf1e89f6dd95c1fcd3147711249
Instruction Fuzzy Hash: 8AA14D74E11219CFEB50EFA5E540AEDBBB6FF88300F109615E519AB345DB30AD46CB90

Function 06A0AEAE Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67002b2833f20fd5c30f903636a05e3fe2607c9f223291abe7da46fa0947d18
Instruction ID: 7ce2e7cf98f6aebcc0a3c398bf08e002c6c9ef0627abecad3a4a9c4df5ee0a30
Opcode Fuzzy Hash: b67002b2833f20fd5c30f903636a05e3fe2607c9f223291abe7da46fa0947d18
Instruction Fuzzy Hash: 60915D74E11219CFEB54EFA5E540AADBBB6FF88300F109615E119AB385DB30AD46CB90

Function 06A06D37 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f256842b3797e2e7a53d2cbf3691b158d3a4140b5faa38c08f5960fe5f0ac9a
Instruction ID: af1dc1c1e9d36fe0a0f9c0e6a73edadea0fa30d890b0273f7d3f57dd044c3a0c
Opcode Fuzzy Hash: 9f256842b3797e2e7a53d2cbf3691b158d3a4140b5faa38c08f5960fe5f0ac9a
Instruction Fuzzy Hash: 0C81A274E042198FEF51DFA8D880AAEBBF5EF49304F1094A9E819EB351D7319A56CF40

Function 06A06FA0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4494a4e7c0f86d845a664f874a4f15ac25bdc502444129cef19bb47bce335ab
Instruction ID: 293bd4b89ac97af8134592f63ed890ddea56fb3832be928dd4fc9e506b6a2e9e
Opcode Fuzzy Hash: e4494a4e7c0f86d845a664f874a4f15ac25bdc502444129cef19bb47bce335ab
Instruction Fuzzy Hash: 6251D171E093889FDB12DFB4D8549DEBFF4EF46210F1584AAE404DB292D7359906CBA0

Function 06A0B448 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c369f8c72679de270b13957f33849e28c6a1ea5f02cff0ed906b4a2219739b
Instruction ID: 6ef1c82b78e74244c8f28d64dcdae4eba0dae30f5bc02c2e60f39d69f778664f
Opcode Fuzzy Hash: 58c369f8c72679de270b13957f33849e28c6a1ea5f02cff0ed906b4a2219739b
Instruction Fuzzy Hash: 0D411874D04208DFEB44DFAAE6406AEFBF6EB8D300F14D069D41AA7291D7355A41CFA4

Function 06A08560 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e77ef0aca5be168337ea46680067fc91a1854d83f15d3333d5d31c3bbcf933
Instruction ID: b282f263de829f7f513c45eb07b3fdb4f2d0adff771cc7140b36c84d8bafd826
Opcode Fuzzy Hash: 83e77ef0aca5be168337ea46680067fc91a1854d83f15d3333d5d31c3bbcf933
Instruction Fuzzy Hash: 4841F8B4E10208DFEB44EFA9D480AAEBBF5EB89310F158469D815EB390D735AD02CF54

Function 06A0854F Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8f8006de001e2fc6b50b28177d1d4ec5aa01bc6bda8e5120009182a2d2e7a5
Instruction ID: c77577a2587677775ed34c3e5cbdc3f07663130f786b93b9c607dd56166a914e
Opcode Fuzzy Hash: 0a8f8006de001e2fc6b50b28177d1d4ec5aa01bc6bda8e5120009182a2d2e7a5
Instruction Fuzzy Hash: BC413874E10208DFEB45EFA8D89069EBBF1EB89310F158469D815EB390DB35DD02CB54

Function 06A0B446 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85a9311573675f2fa88148da08b077ea02e70b8dd390b7eb80b2e333fd7761c8
Instruction ID: 216850234fe2f3f53bf690b3699c6f5f3125082ac25d1d5a17ae2fa3eeed290b
Opcode Fuzzy Hash: 85a9311573675f2fa88148da08b077ea02e70b8dd390b7eb80b2e333fd7761c8
Instruction Fuzzy Hash: 6A4138B4D04208DFEB44DFAAE6406EEBBF6EB8D300F14D06AD41AA7290D7355A41CF64

Function 06A02FB0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e7c5890054f15e6db387a82b6f1bb4b4dcc06a23144d694265237f79f6f26f
Instruction ID: fb2602f5348df53079729c3ccdb70d163c4b6135fd2f52a31f945de7440ad55e
Opcode Fuzzy Hash: 23e7c5890054f15e6db387a82b6f1bb4b4dcc06a23144d694265237f79f6f26f
Instruction Fuzzy Hash: 5341F2B4E1120A9FEF44EFB9E8585AEBBF1EF49300F148425D815E7290EB34D911CBA0

Function 06A05AB0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e0651c21720cfd21c02390f1c1552fee847b5ad32969deb765838419c5aca1
Instruction ID: 9973e3261624ff9d718b19a2501b3c4dcb6b4a3a053bdb629bd29381bc16a56a
Opcode Fuzzy Hash: b2e0651c21720cfd21c02390f1c1552fee847b5ad32969deb765838419c5aca1
Instruction Fuzzy Hash: 7A2137B5E003550FEB12EB3999806EF7FB6EFC5260B15452AD458CF242EA30890A87A1

Function 009ED3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1291538571.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9ed000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee4426b201cca2e2621e6fa3e79c6f151ae937c8b55962fcede04957a88a04e
Instruction ID: 3c0dd4edebd1420349bdef33789613bf1367be0eacb11c225a952ed3fda48527
Opcode Fuzzy Hash: 9ee4426b201cca2e2621e6fa3e79c6f151ae937c8b55962fcede04957a88a04e
Instruction Fuzzy Hash: F2214871504284DFDB16DF00D9C0B16BB65FBA8324F20C569E8090F2E6D33AEC46CBA2

Function 06A04ED8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf057f30a6b2b3bca2e278f06910da405a3de802013545500aa745d64b93761f
Instruction ID: 9d0cd6fe9331e97941e372192f98dbd249de9d4f82c1a59693515fab95a91224
Opcode Fuzzy Hash: cf057f30a6b2b3bca2e278f06910da405a3de802013545500aa745d64b93761f
Instruction Fuzzy Hash: 4C313BB4E1021ADFEB40DFA9D5846AEBBF4FB48700F14846AE915E7340E7349A41CF60

Function 009FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1291617214.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9fd000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076ebc85f4e2adbe7a16029cbd2eab9b430341c8e1e62c19e117a92ce8675320
Instruction ID: 8c74b461aa5355c217eaf91fb52b36a63faf6a300ff89eb5fc908605f56d8080
Opcode Fuzzy Hash: 076ebc85f4e2adbe7a16029cbd2eab9b430341c8e1e62c19e117a92ce8675320
Instruction Fuzzy Hash: 8C212571604308DFDB14DF10D9C4B26BB66EB84314F28C96DDA094B386CB3AD807CB62

Function 009FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1291617214.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9fd000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075bb911ff61c43627ea6f87dbfb13358d3d77c289943132dd1565ea24d0d995
Instruction ID: 9bf72f44ff68eabd5c7ad5f0fe2ee97a3148bcd8afe4146286736cf22b5434b4
Opcode Fuzzy Hash: 075bb911ff61c43627ea6f87dbfb13358d3d77c289943132dd1565ea24d0d995
Instruction Fuzzy Hash: FA213771604308DFDB05DF10D9C0B26BB66FB84314F20C96DDA094B282C33AD806CBA1

Function 06A05C94 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f4464d16df5c4cebd1260e0331baeb91b58de5ea55cf3d4a20743fd02bd2ad
Instruction ID: 672b2a86a03458a10f5988f00cec6c6e9f89e40caa6c9490ae141d57a1da0f6a
Opcode Fuzzy Hash: 08f4464d16df5c4cebd1260e0331baeb91b58de5ea55cf3d4a20743fd02bd2ad
Instruction Fuzzy Hash: DF31E5B0D013589FEB60DF99D989BDEBFF5EB08314F14841AE404AB280C7B55845CF91

Function 06A04EC9 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 637ef04a4e859dad8e2768bad0d79275982dc2856fa8c85797c11e3660a29019
Instruction ID: 2e132031107c1f9c4d753d9e92b76b9e37502a8c7410673f7f73db7622b61368
Opcode Fuzzy Hash: 637ef04a4e859dad8e2768bad0d79275982dc2856fa8c85797c11e3660a29019
Instruction Fuzzy Hash: 43216FB4E1121ADFDB51DFA9D9856AEBBF4FB08700F10846AD914E7280E7349A41CFA1

Function 06A0B5E8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e2d4f5cf91af560372aac20c631a7b4ecc8f4ab8d92cbbc32b02a4fcf7e3de3
Instruction ID: c04e69061b4d8610ea8a9c068cea09b4cd48589a330606effb0668822d0e9004
Opcode Fuzzy Hash: 3e2d4f5cf91af560372aac20c631a7b4ecc8f4ab8d92cbbc32b02a4fcf7e3de3
Instruction Fuzzy Hash: 70212CB4D09209DFDB80DFA9D6809EEBBF5EB49300F1091A5D409A7751D7319E41CFA1

Function 06A05748 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9217ad661838f6ca01cad49114ab6fbb8583f3395a54196664ea3979ab2ad71
Instruction ID: 3f9624a0e269c8691ca5913630486be0288476a201947c0144f7a34a7a39ffe7
Opcode Fuzzy Hash: b9217ad661838f6ca01cad49114ab6fbb8583f3395a54196664ea3979ab2ad71
Instruction Fuzzy Hash: 1631C3B0D013189FEB60DF9AD588B9EBFF5AB08314F24842AE404BB290C7B56845CF95

Function 009FD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1291617214.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9fd000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e64be469edc03c419d7aa3b4f58845dabfde481b33c8f9a36989d24d9b56e408
Instruction ID: 65806bb21e257e9e91e86574d6a1da1f4b7d8338da8b0f55475a96fb3089dc3a
Opcode Fuzzy Hash: e64be469edc03c419d7aa3b4f58845dabfde481b33c8f9a36989d24d9b56e408
Instruction Fuzzy Hash: 63219F755093C48FCB06CF24D990715BF72EB46314F28C5EAD9498F2A7C33A980ACB62

Function 06A0FA70 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4782b2a484a183d9d535236b7af751b84ce13886c95e9af84b7e94da23f370da
Instruction ID: 7647f3d1e5200304d2cf788bd0bf8c5e455d8d2442cd9852d663ccebaaedffe1
Opcode Fuzzy Hash: 4782b2a484a183d9d535236b7af751b84ce13886c95e9af84b7e94da23f370da
Instruction Fuzzy Hash: C4115130F002049FFB68AB79A81477F76A6EBC4750F24852DAC06AB381EA70DD01C7D0

Function 06A0B5F8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e7265fe1f8d355f4cf75bcbaa014199539dba18218a96632e7702e2a962ee9c
Instruction ID: eb06a3bdcb82a07ffe296d6625c3aeae47ce92a4fd7b24261d61e9c38c9f5865
Opcode Fuzzy Hash: 3e7265fe1f8d355f4cf75bcbaa014199539dba18218a96632e7702e2a962ee9c
Instruction Fuzzy Hash: FF21EAB4D04209DFEB80DFA9D2809AEBBF5EB49300F2091A5D809A7751D7719E40CFA1

Function 06A0B6A1 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49df8b0bf5adbd0a08fe2304ba612ab85e7d2d4a6b065c422610c70e8d92d1bb
Instruction ID: 6afe5a5c918be0363284a1ec53489c88cad067f78e4832dc18e35b350bcc8ee8
Opcode Fuzzy Hash: 49df8b0bf5adbd0a08fe2304ba612ab85e7d2d4a6b065c422610c70e8d92d1bb
Instruction Fuzzy Hash: 4E113A74D09208EFEB44EFA9E6909ADBBF9EB49310F049596D4589B352D3309A01CFA0

Function 06A0593C Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62fb34a2f95db8dbf0542afdcf0b9d9c6ae05dfe707c3457e50271fb0c260dc
Instruction ID: 3313b02d1762b11db4f3a8ef63e00d89250c618764138aca1fa9267b2dc52e1c
Opcode Fuzzy Hash: f62fb34a2f95db8dbf0542afdcf0b9d9c6ae05dfe707c3457e50271fb0c260dc
Instruction Fuzzy Hash: 8A2114B5C003499FDB20DF9AD844BDEBBF4FB48310F108429E918A7250C375A945CFA5

Function 009ED3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1291538571.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9ed000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: d5ecf86e06f42882f90a8fc2da1c34d10ccf49fe296376cdd62652b1b335b293
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 6F112676504280DFCB06CF00D5C0B16BF72FBA4324F24C2A9D8090B2A6C33AE856CBA1

Function 009FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1291617214.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9fd000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 611a51f0f7c69a6127251343466808951aa272ae10467fe3120d27f948ab7f4f
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: E311DD75504284DFDB06CF10C5C0B65FBB2FB84324F24C6AED9494B296C33AD81ACBA1

Function 06A07029 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7223d8597eb38532127647faeedff6a275829bc9c5f3e0992084387fda93ed14
Instruction ID: 4b18c0cbbd88d74e93f5db378ef855560acce6031a07b2565b14780cd40c0319
Opcode Fuzzy Hash: 7223d8597eb38532127647faeedff6a275829bc9c5f3e0992084387fda93ed14
Instruction Fuzzy Hash: F901D471A0D2856FEB46EB64DC908DA7FB5CF0726070A80DBE044CF1A3D2359916C7A0

Function 06A0BCC8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70e8871cb9a7d9646081c1bb6218c57983508f12573621eff372f0745b58c82
Instruction ID: ea4dbbfb789257bdeddd8fb307b03d69e1d9cdd5cb167e65e829d1c9b3de0b9b
Opcode Fuzzy Hash: e70e8871cb9a7d9646081c1bb6218c57983508f12573621eff372f0745b58c82
Instruction Fuzzy Hash: FA11E6B1D006189BEB18CFABD8447DEFAF7AFC9300F04C16AD40976294DB7509458FA0

Function 06A0C728 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5772d9e1ea434052d8220478cd9638d50cd002ec36e14770153e1211d79608ce
Instruction ID: 802899ad9810365401dc2487851b169d2a8800e8124564daec86c9b7a96c92e6
Opcode Fuzzy Hash: 5772d9e1ea434052d8220478cd9638d50cd002ec36e14770153e1211d79608ce
Instruction Fuzzy Hash: 64111C70D042089FE748DF6AD4409EDBBFAAF89310F04C169E816A7351DB349845CF90

Function 06A0B6B0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a84c045ae241d25caf9cd7e2d4cbe8757bffa347da9a29da0d3f715c30f91d42
Instruction ID: e6ce89fc7939366564e5c3d2007c48d5050edebda3d74cfb00adebc85d20185c
Opcode Fuzzy Hash: a84c045ae241d25caf9cd7e2d4cbe8757bffa347da9a29da0d3f715c30f91d42
Instruction Fuzzy Hash: 4A110974D09208EFEB44EFA9E6809ADBBF9FF48310F109595D419AB351E331AA41CF90

Function 009ED759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1291538571.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9ed000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3efa4e4e319f679ab4a5891824b72bdbec48a360b918370de8c9dba2afb59871
Instruction ID: 1616f1adbbed73ad055b4d35fceed70e699117795db0e820da84f17d8ebbe83d
Opcode Fuzzy Hash: 3efa4e4e319f679ab4a5891824b72bdbec48a360b918370de8c9dba2afb59871
Instruction Fuzzy Hash: 5E01F7B11063809AE7214B12DC84B26BFDCDF45321F18C91AED080E282C37A9C40CAB1

Function 06A06055 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5551a523f70cf22fef047c15896fff6b3323fa26e193ff5cb47f591c250937c
Instruction ID: d2c8b34d8a4416e959ba890faf10c17fbc4d8adbb9a10e6cd7ac286e34772dc7
Opcode Fuzzy Hash: c5551a523f70cf22fef047c15896fff6b3323fa26e193ff5cb47f591c250937c
Instruction Fuzzy Hash: 55012570844229EFEB11DF6AD8086EEBBB5FF44764F14C628E468AB2D0D7704A45CBD0

Function 06A0CBA8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce19ea5c70d1f9f1742bc3efe69f81d55146d142a9e4ec3697e645c4d9613f2
Instruction ID: 13604815c9737c802794eeaf4959d4a44e3c4ccd854a2df35fb5ed0d816a1599
Opcode Fuzzy Hash: 3ce19ea5c70d1f9f1742bc3efe69f81d55146d142a9e4ec3697e645c4d9613f2
Instruction Fuzzy Hash: 58011275E04108EFE744EFA5D594AADBBF5EF49310F15D19495099B392DA30DE00DF40

Function 06A08430 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55dabc44b279df33435f1dce3ad6fe81d07eac332b9da5f3d147d25cc2a2b7b5
Instruction ID: 85b4a5cdc038e9af17804d2f3a1b677668debce5118b8c77f1aaf868b2f090ad
Opcode Fuzzy Hash: 55dabc44b279df33435f1dce3ad6fe81d07eac332b9da5f3d147d25cc2a2b7b5
Instruction Fuzzy Hash: B0014474E05209AFDB41DFA8D54069EBBF5EF45304F1085AA8818E7381E7359F05CB51

Function 06A08440 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8f5093b71057e48e43ff6145c9f13ed9728580a820e1f3de221098f2a3f647
Instruction ID: 799a1cf8df33d10bf0ac40d09fbcfafb4f2414977b4f27b8b75ab8d4ddc0303c
Opcode Fuzzy Hash: ac8f5093b71057e48e43ff6145c9f13ed9728580a820e1f3de221098f2a3f647
Instruction Fuzzy Hash: EE01ECB4E04209EFDB40EFA9D5406AEBBF9EB48300F1085A98818E7380E7359E01CF51

Function 06A060F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba1402c77a25a7b265de04795e3e98ed1c24c286eea8e4aaec111635ab9b495
Instruction ID: 955d0165668dfc93d5426f619b19c6427004d02f757d84af7317489e814b51c1
Opcode Fuzzy Hash: 8ba1402c77a25a7b265de04795e3e98ed1c24c286eea8e4aaec111635ab9b495
Instruction Fuzzy Hash: 18F090717092A52F9315C76A9C98D6BBFE9EBCA26031581BAF448CB352CA308C05C7A0

Function 06A07F41 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac355119392f7b35e45cb5861614a5d263d4ed96370270193f91ad9e1f3eafe4
Instruction ID: 16dbaf5ec38d921b19bc720f5d0687bcf3cb76ff202089b06700e8188e06812a
Opcode Fuzzy Hash: ac355119392f7b35e45cb5861614a5d263d4ed96370270193f91ad9e1f3eafe4
Instruction Fuzzy Hash: C7F03CB4E09319AFDB41DFA999455AEBFF8EF05340F1085A6D819E7381E7708A01CB91

Function 06A06C18 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b280cc08f8464772aa4764e7f322fbf2133befcde884ec638a950b1e9e1694
Instruction ID: 87fd62e4dbbd80639553ff803f969780e32ff830df034732f97ec8e456e465b9
Opcode Fuzzy Hash: 37b280cc08f8464772aa4764e7f322fbf2133befcde884ec638a950b1e9e1694
Instruction Fuzzy Hash: 18014FB4D0524AAFDB51DFB8D9056AEBBF4EF45300F0481AAD805E7382E7349E14CB91

Function 06A0CB30 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b918ed1f5699ffaa86b1baf236e65c4982807951eed15139adcd84f27a03f9
Instruction ID: d43b87b7b5c3748b80c39f3cff696e293eff2072158c33c80ca1b976171eb522
Opcode Fuzzy Hash: 22b918ed1f5699ffaa86b1baf236e65c4982807951eed15139adcd84f27a03f9
Instruction Fuzzy Hash: ABF03170D0C148DFF744EF6AE4409B8BBB8EB5B311F109295940A5B192D7349E44DB80

Function 06A05898 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f5ae7abd24d3a2b67be4279306b47be9ed6ccaa85e6cfc8a3ebc84c18514eb
Instruction ID: 5b43e4241c12a08767fd32782fa357a5af57cca2b053f29e896adb221ec0a397
Opcode Fuzzy Hash: 84f5ae7abd24d3a2b67be4279306b47be9ed6ccaa85e6cfc8a3ebc84c18514eb
Instruction Fuzzy Hash: 21F0F866C2A3A11FF7237B78A8B12C93F609E92A26B094093C1944E053D814449FC3EF

Function 06A083C8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f936f8aa45c14fabc1794cd907c027d974c30f0f10728432c5cc40a3e2d70fdb
Instruction ID: b3f0b943c81c95f969317892be59921ee7d7069a09ac052502aa12a932fed296
Opcode Fuzzy Hash: f936f8aa45c14fabc1794cd907c027d974c30f0f10728432c5cc40a3e2d70fdb
Instruction Fuzzy Hash: F3F09070D05318AFDF41EFB998042AEBFB4EB09300F0085A6D418E7281D3344A15CB80

Function 06A06C28 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e265b86d9a898d12d67d42a03983bf63f18f1cf53f241850773080940540bfca
Instruction ID: 8e668964511436178cc724d370890568a86e5cd5e2aed80773d9bb24e984f6ab
Opcode Fuzzy Hash: e265b86d9a898d12d67d42a03983bf63f18f1cf53f241850773080940540bfca
Instruction Fuzzy Hash: 120119B4E0420DDFEB94DFB8E5452AEBBF4FB08300F1490A98809E3380EB309A10CB51

Function 009ED758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1291538571.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9ed000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8f364175a09d834860be5ba9d94b2106c6966c461c4b04dacca83eae5ad0f5
Instruction ID: 95d2fccf4dff556edc92dbdda80c71b50cba20c1dcdd743d3afda69336545374
Opcode Fuzzy Hash: 0a8f364175a09d834860be5ba9d94b2106c6966c461c4b04dacca83eae5ad0f5
Instruction Fuzzy Hash: 86F0C2710053809EE7208B06DC84B62FFACEF54734F18C55AED080A286C37AAC40CAB1

Function 06A032D0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afbf4d62d16213014b3438e5f87441580e4da3aeddcf7d63df58f8e1443d1a5
Instruction ID: c4b008cb6e917f7b58d584115b71d090ae359ec82b3f632329930ad534fe2a62
Opcode Fuzzy Hash: 2afbf4d62d16213014b3438e5f87441580e4da3aeddcf7d63df58f8e1443d1a5
Instruction Fuzzy Hash: 97F0EC74E04209AFEB41EFA8D45566EF7F4EB49304F108599C815E7380E7759A05CF81

Function 06A06060 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65d8264369ddf2e9a3bcf7beb032aa347bc34fc2dcbc2e4084fd52580d4830d
Instruction ID: 92bb456cc223935a9e0bb75ddb4bfa23aefeecca068c90c93a207def979507b7
Opcode Fuzzy Hash: f65d8264369ddf2e9a3bcf7beb032aa347bc34fc2dcbc2e4084fd52580d4830d
Instruction Fuzzy Hash: 5E011670C44219DFEB50DF6AD4043AEBAF1BF08364F14C625E424AA2D0D3744A54CBD0

Function 06A043B0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a73debf97ddb6a1779589058ea4080ccba9b6b6835c58557ae4c36be9de305
Instruction ID: c9d6ac32ffba272ffcd87d2e29e5a90a82d8d992f43ce65013fd2b934ba287f7
Opcode Fuzzy Hash: 01a73debf97ddb6a1779589058ea4080ccba9b6b6835c58557ae4c36be9de305
Instruction Fuzzy Hash: 49F0F9B4E05209EFDB44DFA9E5412AEFBF4FB48300F1185BAC819A3240E7348A16CB91

Function 06A043C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e35311cdc5bf7e45711f48bf6b2354ae140d0939f928a86549e2ef07fa96f4
Instruction ID: 2d1531e6cdd801f844b5c221ee3d70d45047f091fabfdfadbc0c91154dd603b9
Opcode Fuzzy Hash: a8e35311cdc5bf7e45711f48bf6b2354ae140d0939f928a86549e2ef07fa96f4
Instruction Fuzzy Hash: 59F0A9B4D05209EFDB44DFA9E5416AEBBF8FB48300F1095A9D919E3340E7309A15CF91

Function 06A07F50 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f408d69bb9baa7dc67598b6545d97dab8522557eb329ab136cb02ea9c2be686a
Instruction ID: b99dc6ab7aa3b112b86863532df8724c0c6eb74c3a162804b802dc4c9b0ec94f
Opcode Fuzzy Hash: f408d69bb9baa7dc67598b6545d97dab8522557eb329ab136cb02ea9c2be686a
Instruction Fuzzy Hash: 8CF097B4E042099FDB44EFA9E5446AEBBF9BF48300F1085A9D819E3340E7309A00CB91

Function 06A0592C Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb35ece4046cd8e554ef8e2bc7e4dcd4d4c0bc6c96a6afd0392c57e9f133e6d
Instruction ID: 687e968db197138c8bc1425c57ca62fa3062bd60371c517513efaa0e1160e311
Opcode Fuzzy Hash: 6eb35ece4046cd8e554ef8e2bc7e4dcd4d4c0bc6c96a6afd0392c57e9f133e6d
Instruction Fuzzy Hash: 33F08271A04108BFBF48EF58ED4099E7FA9EF44360B05C16AE404EB250D631ED148B94

Function 06A0B790 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd72da3e18757c3bdc5b88b295f9c68a1b1542fd767032a53b5da087520f136
Instruction ID: 3790893839f2d664f1a6a28b9d763b14f6f57044001dbc8439569236637fea62
Opcode Fuzzy Hash: acd72da3e18757c3bdc5b88b295f9c68a1b1542fd767032a53b5da087520f136
Instruction Fuzzy Hash: B6F037B0E0021AAFEB84DFA9D941AAEBFF4FB08300F008569E414E7280D7718544CFE0

Function 06A06100 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b997963ee5c8ca3bd3a0b485fc579f52804da2bd59ea86909e4c31530eeebb
Instruction ID: 056c04484e43606c46e40c1d668dc40fe6b9a6d37b55d0a52d2b715c3071d5b6
Opcode Fuzzy Hash: 80b997963ee5c8ca3bd3a0b485fc579f52804da2bd59ea86909e4c31530eeebb
Instruction Fuzzy Hash: B0E039767002286F93149AAAD884D6BBBEEEBCC664355807AF508C7310D9319C0186A0

Function 06A083D8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82804b23037c67fc46a6a6308b7a30aead6fb18616d5b960a655c8fe751dd846
Instruction ID: b9b28b841da6a31b1bbeb1a390e95e3ed42e1c20ba2d8ad68996d324f63ee9a0
Opcode Fuzzy Hash: 82804b23037c67fc46a6a6308b7a30aead6fb18616d5b960a655c8fe751dd846
Instruction Fuzzy Hash: E1F0B7B4D14208EFEF40EFA9E5456ADBBF8EB49300F4099AAD419E3340E7745A54CB84

Function 06A03D30 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958126d63f68ad2bf9700a35c17a77d56a9218d27053db940974e4f4384483ca
Instruction ID: 480daa935abe6e62f69f61f73d6455a2f510f476f09b26e236c4936d8ff8bd01
Opcode Fuzzy Hash: 958126d63f68ad2bf9700a35c17a77d56a9218d27053db940974e4f4384483ca
Instruction Fuzzy Hash: 74F0B7B4D04209AFDF80EFB9E5456ADBBF8EB09300F1099AAC819E3350E7745A40CB40

Function 06A03D21 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd390a60e8065cdbb85388201935b8ac4b4230d1cd69bf173ced77ae5bc21b6d
Instruction ID: b4d05bc32eee4026ce01034f29c2eef135fdd24a27ed4ff1aec88b9faad98737
Opcode Fuzzy Hash: cd390a60e8065cdbb85388201935b8ac4b4230d1cd69bf173ced77ae5bc21b6d
Instruction Fuzzy Hash: 94F03AB4D04209EFEB40EFB8D5852EEBBF5EF45300F008AAAC819E3251E7705A15CB40

Function 06A0B7A0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5568945a365b13aa53ed38fa61b7caf582d25481d5aa274f7f8977c68016af6f
Instruction ID: 779c8034aa1068e92cbc325bd754a1783bb584c868b41062ff671aed1ff29929
Opcode Fuzzy Hash: 5568945a365b13aa53ed38fa61b7caf582d25481d5aa274f7f8977c68016af6f
Instruction Fuzzy Hash: 9AF030B0D0420A9FDB84DFA9D901A6EBBF4FB48300F004569D514E7350D77189048FE0

Function 06A0B738 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9f6e13e3be686adbc5e02b03a2e3aa89b276e69ecb8b96aae6c735efe03359
Instruction ID: 893db670417d0f3b4cab0fe170ac0377075a8e9e61cc65c9dcf21a41f97e02fc
Opcode Fuzzy Hash: bb9f6e13e3be686adbc5e02b03a2e3aa89b276e69ecb8b96aae6c735efe03359
Instruction Fuzzy Hash: B9F01C70A81126AFD790DF7AC949A8F7FF4EB04600F108469E019D7252D77181018FE1

Function 06A08508 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c2c73b11996fdcc9ef1eb74d07746a7e8c5bc075cf60f36d2c0c7bdbd2138f
Instruction ID: 2712c8c01425cb31f21ea3168d7627eb3b69d89222b03f559796622174cce845
Opcode Fuzzy Hash: 05c2c73b11996fdcc9ef1eb74d07746a7e8c5bc075cf60f36d2c0c7bdbd2138f
Instruction Fuzzy Hash: 4EF0C9B4D54208EFDB90EFB8E4446AEBBF4EB0A300F1095A9C409E3280E7385A50CB45

Function 06A0E558 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781332c1ef715556e16fef6f9cd5a2b6710ca49819f74f0073b32c7f950deb8d
Instruction ID: 594bbc60b1d8b37b3a5466526da33de438f5ee9f0cbc1cdc2125aa7169bcd287
Opcode Fuzzy Hash: 781332c1ef715556e16fef6f9cd5a2b6710ca49819f74f0073b32c7f950deb8d
Instruction Fuzzy Hash: A9F0E574E083489FF7A0FB66F404BAD7AFEBB89301F50C8208516572D5DE701805DBA2

Function 06A0B82F Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c779289d27fff1f46e5bc16661214698c9e5de5dea5ebe8d9676d267aa892ff
Instruction ID: fb8e0dd10057ab4ec1c3579df600309305048cc8bab91d7b33a1ddb144b905bb
Opcode Fuzzy Hash: 2c779289d27fff1f46e5bc16661214698c9e5de5dea5ebe8d9676d267aa892ff
Instruction Fuzzy Hash: D9E0DF326591190F9B82EBA4BD00C927F68DB1666030184A2E80CCF072E612C83AC3E1

Function 06A05FBD Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25ce69fc3642d2787fc955ffa585a7ae8713828466489d3d02c491bae3aa4dc
Instruction ID: 6bd29110911a50d17746dba8bf74403b60f7eb17aed2ad8fb26fccd3b48b0823
Opcode Fuzzy Hash: e25ce69fc3642d2787fc955ffa585a7ae8713828466489d3d02c491bae3aa4dc
Instruction Fuzzy Hash: 9FE0CD76D01135AB8711AFB5AC058DFFF38EF05650B014011F4155B200D3700722CBD1

Function 06A0FA10 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fac3fd8dafd5ed9579dd1bc71189608118a5f340bcb7c0d09f4e723f61ace86
Instruction ID: 503ea0acba2cac1139415a4ba5bfc2d7245d7777ca3f4f6ccc6b1534720f29f2
Opcode Fuzzy Hash: 7fac3fd8dafd5ed9579dd1bc71189608118a5f340bcb7c0d09f4e723f61ace86
Instruction Fuzzy Hash: 93F03975D0020CFFDB41EFA9E44468CBBB5EB88301F10C0AAAD18A7390E6346E61DF41

Function 06A0A2A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61da586773fbbc689e306914fe69b4d4b297be066bfa62a2c0d7cb892a0a31a
Instruction ID: 4393ecc31d146ec19498e7d0f1fa26665a05cb5ef62e9955a9bf54be4616a338
Opcode Fuzzy Hash: c61da586773fbbc689e306914fe69b4d4b297be066bfa62a2c0d7cb892a0a31a
Instruction Fuzzy Hash: EFD02E3010E3A06FD313276678082AA3F64EB03201B000281E68C8B0E3CA644D2BCBF2

Function 06A04E90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fafa0cb26ca2eda50613326bb1507ce3b6fb3f82e0a41dbf55585e76bf275b1
Instruction ID: 3a7c1096c7aeae5690d4a2994b720e4671e4462246b5d906a3ac688d11b8873c
Opcode Fuzzy Hash: 9fafa0cb26ca2eda50613326bb1507ce3b6fb3f82e0a41dbf55585e76bf275b1
Instruction Fuzzy Hash: CBE08C30D0020CEBEB80FBA4A8046AE76F8EB0A300F500598C505573C0D7711E58D6C1

Function 06A055D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c419ad107fb9032997f0053bf620bee459ee5e270f4882df563e8ec1343ab04
Instruction ID: 925160d690d0699cf2fda3473a55efb49eaf083fa02d4ef8f41d005c7966499f
Opcode Fuzzy Hash: 9c419ad107fb9032997f0053bf620bee459ee5e270f4882df563e8ec1343ab04
Instruction Fuzzy Hash: 55D012710896A16EE35766105D2ECA73F68FA575907168883E8C9CF0B3CD14892BD7E2

Function 06A0B748 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a1a027f93f7afeb9cdc729ca55c34cf048364f77a19b71c3c33ac6dfd273ff
Instruction ID: d227746782c41b36e799f47c1448f3d99b6b3b495d6f12e220a74340787b3685
Opcode Fuzzy Hash: 74a1a027f93f7afeb9cdc729ca55c34cf048364f77a19b71c3c33ac6dfd273ff
Instruction Fuzzy Hash: 85E0B6B0D40209EFE780EFB9DA45A5EBBF0BF08700F1185A9D019E7361E77596058F91

Function 06A05FC8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
Instruction ID: fc30ac6c173ae90ec36587ee39c3faba4919df6e71f682090eca5ef24ff906de
Opcode Fuzzy Hash: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
Instruction Fuzzy Hash: CAD09E72D001399B8B10AFE9DD054DFFF79EF05650B418126E915A7100D3755A21DBD1

Function 06A0AA81 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b970c445a1b40ce27c176255b0b4890a198d7318b5624ee2e316a9cba9e49c
Instruction ID: a123b12f22ce89564124bd567187f8e97160575e9e3607340ab5b409a4a29ec6
Opcode Fuzzy Hash: e6b970c445a1b40ce27c176255b0b4890a198d7318b5624ee2e316a9cba9e49c
Instruction Fuzzy Hash: BDD09275A16219CFEB60EB54EC40BDCBBB5FB84215F0012A2D10DA7615D7312EA5CE41

Function 06A0C02A Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c6c2276a66e0d6129871dc0e6a45f6d76ee7d0e00608af3a736a590444342f
Instruction ID: cba9d3552ea252d836c103a59c880980b2e56898f11ecc857245222cc2c6a888
Opcode Fuzzy Hash: b7c6c2276a66e0d6129871dc0e6a45f6d76ee7d0e00608af3a736a590444342f
Instruction Fuzzy Hash: 0FE06770904298CFE7549F65E544A58B7B5FF4A316F501499E40A6B291CB3A9D81CF10

Function 06A0A2B0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313f433eb38a2543b8ebc387d6b690e41b38e41f518d35564c3a7ded7f8ac1c2
Instruction ID: e3ac0969a6eb5c82e8b26741d282405732c5aa40fe3c4160ba54eb86cacb6c26
Opcode Fuzzy Hash: 313f433eb38a2543b8ebc387d6b690e41b38e41f518d35564c3a7ded7f8ac1c2
Instruction Fuzzy Hash: E8C08C7140074897E30037AAB40C32873A8AB06302F801160EB09008A24AB41C24CEA6

Function 06A058E4 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2bfe36502f9b3b42004879752224e16ef75c5066b0934a01d4f146647215f2
Instruction ID: 3273aa03a361b21f32719da7c33191d082385ac71502df90ae852a84edf85414
Opcode Fuzzy Hash: ab2bfe36502f9b3b42004879752224e16ef75c5066b0934a01d4f146647215f2
Instruction Fuzzy Hash: FCB012B59A9300B7719477F05E40B2F5811EFB1750B048C023244560C0C871E83AD66B

Non-executed Functions

Function 06A0F5D8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47b5101079dfe5042404e5956ed929c374e9500102500c799b3f997a9357439
Instruction ID: 848c986f1f1f1a0c19200b0234152ef4742b5449b9d3b50ba1d604571f4169b2
Opcode Fuzzy Hash: f47b5101079dfe5042404e5956ed929c374e9500102500c799b3f997a9357439
Instruction Fuzzy Hash: 66E1F974E002198FDB54DFA9D580AAEFBB2BF89304F248159D855AB356DB30AD41CFA0

Function 06A0F1A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb32263880eb1c2f3978047405d6b2cc0967ba1c2fe1359c5a306a69e7acc02
Instruction ID: 2fe45191ac478f2d7c4308d63d0d0043459f9c393d13189f09726276f56a9bd1
Opcode Fuzzy Hash: 8cb32263880eb1c2f3978047405d6b2cc0967ba1c2fe1359c5a306a69e7acc02
Instruction Fuzzy Hash: 19E1F874E002198FDB54DFA9D580AAEFBB2BF89304F248169D855BB356C730AD41CF61

Function 06B40040 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855b6b4d3886a6f4a26d9fc84f37cb0eff281a09ef90956dbcf2bcfea658b757
Instruction ID: 9081c9217df687cfa5dad7fc064e81a2644a352cf92407c8ccc032eefe19745c
Opcode Fuzzy Hash: 855b6b4d3886a6f4a26d9fc84f37cb0eff281a09ef90956dbcf2bcfea658b757
Instruction Fuzzy Hash: 7AE10AB4E002198FDB54EFA9C580AAEBBF2FF89304F248159D555AB356DB30AD41CF60

Function 06B409F0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40e6f60952e7cb20c2e21e0fce50dc1a1a9e5d5ae93a0e68e6bb84a63a9322d
Instruction ID: 6ea370b1552676af4ca2b98a66d0270f419afa17ea2eed654c4645e31176e44e
Opcode Fuzzy Hash: f40e6f60952e7cb20c2e21e0fce50dc1a1a9e5d5ae93a0e68e6bb84a63a9322d
Instruction Fuzzy Hash: 67E1F9B4E002198FDB54EFA9C580AAEBBF2FF49304F248169D555AB356D730AD41CF60

Function 06A06669 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf173504f81d3db82097126447f40b35ab3f95418821808c67995c1ce6080883
Instruction ID: 3e31a7eb591cea83f5b8d294bc796cccdc4cb1d227717d56c639a26edbafd7cc
Opcode Fuzzy Hash: cf173504f81d3db82097126447f40b35ab3f95418821808c67995c1ce6080883
Instruction Fuzzy Hash: 77E13835D10B5A9ACB10EF64D8946A9F7B1FF95300F20C79AD0093B214EB70AAD9CF91

Function 06A06678 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95233af3f445061237da44219b9dfdb757ff9135e7dd110468f4f4388c788519
Instruction ID: ea060d6a416c5a0a36002d4224506967183eea8d687028d4e8510dfbb910f4ef
Opcode Fuzzy Hash: 95233af3f445061237da44219b9dfdb757ff9135e7dd110468f4f4388c788519
Instruction Fuzzy Hash: F4D12735D10B5A9ACB10EF64D9946A9F7B1FF95300F20C79AD0093B214EB70AAD9CF91

Function 0227D57C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1291933981.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2270000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fea1da0cd2a22a7baee936e2e728e166a9f7ca62c1cc6b31ffd20311b3076ba
Instruction ID: ad8c6603baaf94cd863f608232cc790c816be6bc1fc37db2bf2c832d5d2098e1
Opcode Fuzzy Hash: 0fea1da0cd2a22a7baee936e2e728e166a9f7ca62c1cc6b31ffd20311b3076ba
Instruction Fuzzy Hash: 97A17C32E28206CFCF15DFB4CA4459EB7B2FF85304B15856AE801AB669DB71E916CF40

Function 06B40006 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297291642.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b40000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee8b6ee044b94a525fa839d50db9447169960d4e2aaf9ffc8703aa09a390e591
Instruction ID: 10405701a14956bb1306a4c19dda6be458c6bb69e9d12cb2fe1e71ca003c21a9
Opcode Fuzzy Hash: ee8b6ee044b94a525fa839d50db9447169960d4e2aaf9ffc8703aa09a390e591
Instruction Fuzzy Hash: B4517EB4E042198FDB54DFA9C5805AEFBF2BF8A304F1481AAD458AB356C7309D42CF61

Function 06A034A8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1297213461.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a00000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e24fc5b9b9aaa9f4bf54947500737bb618370f8c2e7d2865cf5334c974a18051
Instruction ID: 65fc31178ab1f81e796648964900c4c2519f873bf335c23afdd228e8a1805d29
Opcode Fuzzy Hash: e24fc5b9b9aaa9f4bf54947500737bb618370f8c2e7d2865cf5334c974a18051
Instruction Fuzzy Hash: E341B971E016299BEB68DF6ADC4079AFBF3AFC9300F14C1A9D408AB254EB305985CF51

Analysis Process: Quotation.exePID: 1792, Parent PID: 6536COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06973108 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 069737DE
$q, xrefs: 06973813
$q, xrefs: 06973807
$q, xrefs: 06973837
$q, xrefs: 0697382B
$q, xrefs: 069737EA

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 16fdc93218af29a8132bdef1b77edb5f19ab73d1ad1012dfb798ea414ea8c3f6
Instruction ID: c48f3dc66d598f6c04bc3b0f221c81d0653bcc107029f27331d6a4d618b6ba12
Opcode Fuzzy Hash: 16fdc93218af29a8132bdef1b77edb5f19ab73d1ad1012dfb798ea414ea8c3f6
Instruction Fuzzy Hash: 95320F31E10B198FDB14EF79D85069DF7B6BFC9300F2096A9D449A7614EB30A985CB90

Function 06975240 Relevance: 1.8, Strings: 1, Instructions: 593
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 0697594C

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: f12462aec49d3481a90f1998becba063eac6a9c5930d159a409daee695b9416c
Instruction ID: 48eb1cd07f5777aeab4a80d24935a622b700292452ba3f4d6088be92b80c8e04
Opcode Fuzzy Hash: f12462aec49d3481a90f1998becba063eac6a9c5930d159a409daee695b9416c
Instruction Fuzzy Hash: 6C229F71E002188FDFA4DBA8D4806AEBBB6FF85320F258469D845EB794DE31DC45CB91

Function 0697233A Relevance: 1.0, Instructions: 1033COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1d1bd78524241e662d04d78edcf4b9bcc64201cb05d62426f02d35ab197a34
Instruction ID: 920157d317288610f915f671d0f7d75c2a2bbaabfe02bbb73b8a802d79522f08
Opcode Fuzzy Hash: ee1d1bd78524241e662d04d78edcf4b9bcc64201cb05d62426f02d35ab197a34
Instruction Fuzzy Hash: 2F925734E102088FDBA4CB68C588B9DBBF2FB45314F6884A9D4499B765DB31ED85CF80

Function 06976290 Relevance: .8, Instructions: 836COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e6e01f38b27daa73ed7f860c53419110a93741a243fe2ccd65398566a6f9ec
Instruction ID: 376f4f692be6dda346bf2d82f52801a854aa2c2f813bb20aa0e591e6b496b549
Opcode Fuzzy Hash: 36e6e01f38b27daa73ed7f860c53419110a93741a243fe2ccd65398566a6f9ec
Instruction Fuzzy Hash: 48628C34A00A089FDB64DB68D590BADBBF6FF88314F248469D805DB795DB31ED46CB80

Function 0697C220 Relevance: .6, Instructions: 646COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52628f9736dc1bac18d1e209c152688b0bc982163a5860fa3dfaf908689a5138
Instruction ID: 719ac6557f1d4acc605a8e8ebaedabea0b2c7259a2f6896acc5dddf4fdd66aa1
Opcode Fuzzy Hash: 52628f9736dc1bac18d1e209c152688b0bc982163a5860fa3dfaf908689a5138
Instruction Fuzzy Hash: 70326F34B00209DFDB54DB68D990BAEBBB6FB88314F208529E405EB794DB31EC45DB91

Function 0697B2BB Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3534d8c14de4b4a3fe6d600e7dcffb165d2249dce6e62445e0b2d34e38b47932
Instruction ID: e24ae827685f022cff61bdb3edc197d324a05099b34588d5b81d2c2a6331e2c0
Opcode Fuzzy Hash: 3534d8c14de4b4a3fe6d600e7dcffb165d2249dce6e62445e0b2d34e38b47932
Instruction Fuzzy Hash: D5225E30E002098FEF64DF68D4907AEB7B6FB49310F24852AE415DBB99DA35DC81DB91

Function 0697AD60 Relevance: 10.4, Strings: 8, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 0697AED4
$q, xrefs: 0697AF38
$q, xrefs: 0697AEE0
$q, xrefs: 0697AF03
$q, xrefs: 0697AF0F
$q, xrefs: 0697AF2C
$q, xrefs: 0697AE81
$q, xrefs: 0697AE8D

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: 7635002fc7e39f13c4e936e52cd1653f2f51639cd9b9bbe0ab5ff76f66b78978
Instruction ID: fad6203c5622694734ef75fad1bce357e3525a9778c87e269a907a31c7aabe00
Opcode Fuzzy Hash: 7635002fc7e39f13c4e936e52cd1653f2f51639cd9b9bbe0ab5ff76f66b78978
Instruction Fuzzy Hash: 23E16D30E103098FDB65DF69D8906AEB7B6FF84315F208929E8059B758DB31EC46CB91

Function 0697B6E8 Relevance: 8.0, Strings: 6, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 0697BC79
$q, xrefs: 0697BC6D
$q, xrefs: 0697BCAD
$q, xrefs: 0697BCA1
$q, xrefs: 0697BC45
$q, xrefs: 0697BC39

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: d2012d64c6bc2f569a758cb3a0573d6955edded3c90997e8389f9dca91873b8c
Instruction ID: 9402710bad6cad05a59dbf5374cde3282aadc143604065c2ef690d754384d0de
Opcode Fuzzy Hash: d2012d64c6bc2f569a758cb3a0573d6955edded3c90997e8389f9dca91873b8c
Instruction Fuzzy Hash: 42027930E002098FDFA4DF68D4807ADBBE6FB85314F24852AE415DBA49DB31ED85CB95

Function 069791E8 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06979293
$q, xrefs: 06979264
$q, xrefs: 0697929F
$q, xrefs: 06979258

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 36db3dbf32a5b466791f918245d472c8ae35b56599440c97df116a76a11334cb
Instruction ID: 9f5dffbd4720e1ba69ece0d6a061d8133dda39498c08b50943e506ed7378b75f
Opcode Fuzzy Hash: 36db3dbf32a5b466791f918245d472c8ae35b56599440c97df116a76a11334cb
Instruction Fuzzy Hash: 8A917030B006198FDB64DB69D851BAEB7B6FF89300F108565D8199B748EF70DD46CB90

Function 0697CFE0 Relevance: 4.6, Strings: 3, Instructions: 803
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 0697D3EB
$q, xrefs: 0697D3DF
$q, xrefs: 0697D3D7

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: 573a844b4edf67edd53563f78decf3764a81ea456f4807540343e78ca8b8e43d
Instruction ID: c4cf1406829ba807868339d3482044acf1c9983e5aa51ab8699069edd899d429
Opcode Fuzzy Hash: 573a844b4edf67edd53563f78decf3764a81ea456f4807540343e78ca8b8e43d
Instruction Fuzzy Hash: 45626E34B0031A8FDB55EB68D590A9EB7B2FF84304B248A28D4059F759DB31FC4ACB85

Function 06974808 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPq, xrefs: 06974935
\Oq, xrefs: 069749BF
fq, xrefs: 06974F15

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: fq$XPq$\Oq
API String ID: 0-132346853
Opcode ID: 68d547d6acd74faf13eaf24bd66fab53a0a00c8af0ab107c31ecfca4df9b2263
Instruction ID: ee427f49959fa2d41b46aac599990a34cd5c3d17f508823af67a750c9b591502
Opcode Fuzzy Hash: 68d547d6acd74faf13eaf24bd66fab53a0a00c8af0ab107c31ecfca4df9b2263
Instruction Fuzzy Hash: EA618F30F002089FEB549BA8C9547AEBBF6FF88710F20852AE506AB395DF754C45CB95

Function 06978118 Relevance: 2.7, Strings: 2, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 0697815D
$q, xrefs: 06978169

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: d13ff23b5952ab0c26bfc5aea8e5f195913bf59eb9ae9961bf73a116b0f9dd7a
Instruction ID: 8746a8495dbac1bdae76eab46aa3f31f4a7d214039eaba5dd57ea585bf4ea978
Opcode Fuzzy Hash: d13ff23b5952ab0c26bfc5aea8e5f195913bf59eb9ae9961bf73a116b0f9dd7a
Instruction Fuzzy Hash: 83819F30B006148FDB58DB79DA547AEB7A6BF84304F208538D815DBB58EB71EC82C790

Function 069791D8 Relevance: 2.7, Strings: 2, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06979293
$q, xrefs: 06979258

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 51f06f0dc8573d7feb8138230a5d3ae867197ffa7814e395deac8b4801627df7
Instruction ID: bdf6d647bd9db057be3f2ce7091ea3f6d736f08043f6f80012f7e9d8fdaabc49
Opcode Fuzzy Hash: 51f06f0dc8573d7feb8138230a5d3ae867197ffa7814e395deac8b4801627df7
Instruction Fuzzy Hash: 45518130B016089FDB54EB69D961B6EBBE6FF88300F108569D809DB748EB71DC46CB91

Function 010BE580 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.3737367032.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39b4feeb4a2a193a6dabb36715579a5004e2873f3c4880efcc881ff4d98471c
Instruction ID: 5733fc6369fa37f675e334cf1705ee01eefdb206452d9f6e4150ad4be6d588b6
Opcode Fuzzy Hash: b39b4feeb4a2a193a6dabb36715579a5004e2873f3c4880efcc881ff4d98471c
Instruction Fuzzy Hash: 3D412132D003499FDB10DFB9E8047DEBBF5AFC9210F15856AE904A7281EB349845CBE1

Function 010BE668 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 010BE6CF

Memory Dump Source

Source File: 0000000D.00000002.3737367032.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10b0000_Quotation.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: f546c088c4876848afe855d327e7fdbc1033454e26cd7ce44b9c95cffe0271bd
Instruction ID: 4f896055b0bf1343c71007ff5d77926b5a62735213ba3213969ad748f18698e5
Opcode Fuzzy Hash: f546c088c4876848afe855d327e7fdbc1033454e26cd7ce44b9c95cffe0271bd
Instruction Fuzzy Hash: CF1123B1C0025A9BDB10DF9AC445BDEFBF4AF48320F10816AD818A7240D778A945CFA5

Function 069747F9 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

XPq, xrefs: 06974935

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: XPq
API String ID: 0-1601936878
Opcode ID: 849152d6228001d7bc4ccb558f070e61e7ba82db31c94081c561f4e85c2b0efe
Instruction ID: fa0c424f29624ac81cb8edb60aacc62b70eb9b0aef03a4b292c5bb0752daebc2
Opcode Fuzzy Hash: 849152d6228001d7bc4ccb558f070e61e7ba82db31c94081c561f4e85c2b0efe
Instruction Fuzzy Hash: F7416E30B002089FEB549FA9C854B9EBBF6FF88700F208529E545AB395DF719C05CB91

Function 0697DB55 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

PHq, xrefs: 0697DCB1

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: d8f3e77252b20257c599bb8ad406b5ef64a4838f7228204a7695bc6fa7f4813f
Instruction ID: e8097d7d6bfb4cd081305f0c4b7939dfb09b20d8a0cb9610c32b623b2800c07a
Opcode Fuzzy Hash: d8f3e77252b20257c599bb8ad406b5ef64a4838f7228204a7695bc6fa7f4813f
Instruction Fuzzy Hash: 5F41C170E00309DFDF65DF65C49469EBBB6FF85300F24452AE402EB644DB71A84ACB81

Function 069721AD Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

PHq, xrefs: 069722FB

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: e34d4602ed702dff9006ef70f70129532f64560ddef90bbe3af033634415f953
Instruction ID: 29fa8b06b92f79eda5f610c843f546423f27cb95448b5d8a8ddc162020fa15a8
Opcode Fuzzy Hash: e34d4602ed702dff9006ef70f70129532f64560ddef90bbe3af033634415f953
Instruction Fuzzy Hash: E0311430B102098FDB69AB74C56466F7BE2AB89710F244569E842EB748DF35CD02C7D1

Function 069721C0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHq, xrefs: 069722FB

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 5c5eac1424b9528686bd7cef509581c44d0d072c5978ddedbc306268192bc432
Instruction ID: efe254ebdc1bafe681be7eec7cb569173ba0b755a605706edd4028698dcd4eb1
Opcode Fuzzy Hash: 5c5eac1424b9528686bd7cef509581c44d0d072c5978ddedbc306268192bc432
Instruction Fuzzy Hash: 8A31D030B102098FDB69AB79C55466F7BE6BB89710F204568E402EB348EF35DD02CBD5

Function 06978109 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

$q, xrefs: 0697815D

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q
API String ID: 0-1301096350
Opcode ID: 492e7f91711b0eda662afa61bdb0ac613e8f238f68a091859cdb7b7002de9e51
Instruction ID: 9e00b48c7dd19132dc83c8f995e4b21b325793b521c2b1a87545606c56be7447
Opcode Fuzzy Hash: 492e7f91711b0eda662afa61bdb0ac613e8f238f68a091859cdb7b7002de9e51
Instruction Fuzzy Hash: 81019C36E04208EFDB248E61EE496AABFBCFF80320F140879D950E3950DB309D41C790

Function 069746F1 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Oq, xrefs: 069746FD

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: \Oq
API String ID: 0-643489707
Opcode ID: 948807994aed6de4b855cc4219ff215337d73de009ad6ad1dc3b50191fde71ac
Instruction ID: 42b74d12d15a491072b4e283fd697b5a6069159eb8a4bb82beb6b40aecb9f180
Opcode Fuzzy Hash: 948807994aed6de4b855cc4219ff215337d73de009ad6ad1dc3b50191fde71ac
Instruction Fuzzy Hash: C3F0D430A50219DFDB14DF94E869BAEBBB2FF88B00F204519E402A7694CB741C45CFC0

Function 06975E90 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9acc456762cbd0f640c3cd206ea4f6fd1efdd2ac0b9522a37d6db47fda125414
Instruction ID: 9c0088d2afc9fa280eae8a45f7545a75714b7f1b31d8baf84b39b2cd8b2e6805
Opcode Fuzzy Hash: 9acc456762cbd0f640c3cd206ea4f6fd1efdd2ac0b9522a37d6db47fda125414
Instruction Fuzzy Hash: 3F61A771F005214FDF549A7EC8406AFBADBAFC4210B294439D80AEB364DEB5ED4287D6

Function 06973F40 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9004e4336db6e33f6515301b2ec8ee03368086c397905cf76a37e1665024de
Instruction ID: 24e41b6ea0bc9e918b99c5716c6eea6b2c966e3bcdb4752ed5a300dbe31e38eb
Opcode Fuzzy Hash: bf9004e4336db6e33f6515301b2ec8ee03368086c397905cf76a37e1665024de
Instruction Fuzzy Hash: AB813D30B006098FDB54DBA9D5507AEBBF7AF89300F208529D40ADB759EF31DD468B91

Function 0697425C Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec50fc827de0efcca2f8f3e7afc87807af1458d7ee9c8c861bb4b0fd2a65ad3c
Instruction ID: 64111ca02cef4b8eaff3a558b27b8f814bac090ab5bb1afc27acda713d348992
Opcode Fuzzy Hash: ec50fc827de0efcca2f8f3e7afc87807af1458d7ee9c8c861bb4b0fd2a65ad3c
Instruction Fuzzy Hash: 6C913D34E006198FDF60DF68C890B9DBBB1FF89310F208599D549BB295DB70A985CF91

Function 06974270 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a64c225af2b9f9c005cdb2bb166941eeed748444bf36b52ac4d6518533fac10
Instruction ID: 45b468bf2dcb7897bbb997f425b89f5f2e9c6e822be0cc2e0e4cc2e452d4d654
Opcode Fuzzy Hash: 4a64c225af2b9f9c005cdb2bb166941eeed748444bf36b52ac4d6518533fac10
Instruction Fuzzy Hash: 84912D34E106198BDF60DF68C890B9DB7B1FF89310F208699D549BB385EB70A985CF91

Function 0697EBB3 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d90ab8310eb6cd868183506e55897d3fb9b80efc163926dddefc1bfbe8d7f7e
Instruction ID: 88eb7292056a82aa575b586789a2ff1f6a00a394a355e0768937038e1d393d50
Opcode Fuzzy Hash: 0d90ab8310eb6cd868183506e55897d3fb9b80efc163926dddefc1bfbe8d7f7e
Instruction Fuzzy Hash: 4F713C34E002099FDB54DBA9D980AAEBBF6FF88300F248569D405EB754DB30ED46CB54

Function 0697EBC0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4491701e5db89a11953504781f5d1ee51c5412c60f69354ac83fcdab111acef3
Instruction ID: 0600a588888a552636309d8800ef3725a86974d6a9f05b66e039f5e1d5c6d4d1
Opcode Fuzzy Hash: 4491701e5db89a11953504781f5d1ee51c5412c60f69354ac83fcdab111acef3
Instruction Fuzzy Hash: 88712B34E002099FDB54EBA9D980AAEBBF6FF88300F248569D405EB754DB30ED46CB55

Function 0697FD29 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e80c11f3b2f4701aac860e5ab4398ac178389b3fa004cefe10bfb5790339ec
Instruction ID: 2a4e213850fa0eece247fe0122eb03f20703a74134af50ce688ab496818e6dcf
Opcode Fuzzy Hash: 67e80c11f3b2f4701aac860e5ab4398ac178389b3fa004cefe10bfb5790339ec
Instruction Fuzzy Hash: 64510431E002089FDF64EF78E4546AEBBB6FF85315F20886AE106E7654DF318845CB84

Function 0697F6D0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de675c8241b5ea7a039a24ffacb280fbea1bd739aa7d1b82b63598b4fd0d5442
Instruction ID: 27eac760e91b6bf09432ac7cb0b39b74b58338229cdf2eb1313e4c59d706955f
Opcode Fuzzy Hash: de675c8241b5ea7a039a24ffacb280fbea1bd739aa7d1b82b63598b4fd0d5442
Instruction Fuzzy Hash: A251A834F102149BEF74666CD89476F3A5EE789310F30442AE50BE7B99CB79DC4293A1

Function 0697F6E0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b559ef1b67ad06fb93c035a134601345f1f450b738e5b87ed7991625f467c5
Instruction ID: 48b4e34d5322fd241204d28bb190fdbebc717b1103d648537f2ef7693db20d4c
Opcode Fuzzy Hash: 82b559ef1b67ad06fb93c035a134601345f1f450b738e5b87ed7991625f467c5
Instruction Fuzzy Hash: 2751B634F102149BEF64666CD894B6F365EE78D310F304429D50BE7B99CB79DC4293A1

Function 069750B0 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe802b6358c3cb14876e3dab09bf6028850bfc2a2923f20e6b2d48c56dc407d
Instruction ID: 4e34011743b6bb52425bf10f332f24e5c08049e09ffc3c72e1ca40752dffd10f
Opcode Fuzzy Hash: efe802b6358c3cb14876e3dab09bf6028850bfc2a2923f20e6b2d48c56dc407d
Instruction Fuzzy Hash: D8417F31E006098FDBB0CF99D880AAFF7B5FB84310F21492AE155D7A50DB30E8458B91

Function 0697DA08 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb4a2b9ed0d02260b7e1b08d9c943f091f3944d87bd91b9ee4f223767ecee96
Instruction ID: 7ce39f6be275ef46ae96dd7d922d912b6139e212ee397cf648b8afa65c84505c
Opcode Fuzzy Hash: 4cb4a2b9ed0d02260b7e1b08d9c943f091f3944d87bd91b9ee4f223767ecee96
Instruction Fuzzy Hash: 0431C634E1071A9FDF29DF64D840A9EBBB6FF85310F244529E805EB644DB70B94ACB90

Function 06972070 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387da6591170031371241d7ede013cc83f4788c57200a0b933cb92116a8e93a7
Instruction ID: 844f3de58a0f6cf5d2e2e840b8aba720ee3f1bea84eb7011951f0339993ed38c
Opcode Fuzzy Hash: 387da6591170031371241d7ede013cc83f4788c57200a0b933cb92116a8e93a7
Instruction Fuzzy Hash: C0319C34E102099FCB59CF74D854AAEBBF6BF89300F208419E946AB754EB71ED46CB50

Function 06972080 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02bb9e3685016c026e23f3b50f7e523072cb3b2130e4fb79c05c041504db3f4a
Instruction ID: 7b26e9450248f061f7828d09ce1d843f72701b23018cb19798abd3b83ff5242c
Opcode Fuzzy Hash: 02bb9e3685016c026e23f3b50f7e523072cb3b2130e4fb79c05c041504db3f4a
Instruction Fuzzy Hash: 7D317A30E206099FCB59CF64D854A9EB7F6BF88310F208529E906EB754DB71AD46CB50

Function 06973B48 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d8a8fb76192633f4ce0013294731785dfad640262b4a6b4562e701786a55e1
Instruction ID: 7a936ab47174ca1a46aec25823f04774152d39d257f9964a4e1e4d8e42b85ad7
Opcode Fuzzy Hash: a3d8a8fb76192633f4ce0013294731785dfad640262b4a6b4562e701786a55e1
Instruction Fuzzy Hash: DA218D75F00A18AFDF50DFA9D941AEEBBF5AB49310F108025E905E7754EB30D941ABA0

Function 06973B58 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6bc4a2f30b8a374b025c58b3984d2039a616fee044da878a7ddc4439996051
Instruction ID: 9d351b068c3aa4a7da032bb8cb970a9e1ef7ad0c7610edc1a497e02f62a67866
Opcode Fuzzy Hash: 5b6bc4a2f30b8a374b025c58b3984d2039a616fee044da878a7ddc4439996051
Instruction Fuzzy Hash: AE216975E00A189FDB50DFA9D981AAEBBF5EB48310F148029E905E7754EB31D940DB90

Function 0106D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3737109013.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_106d000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbb68f71a8888572499b5677c37180cac2e987cddf84ce317f3d90f50e184a8
Instruction ID: b3308719b5d607bb81f1d43cd6eb39edac36ff9b4caa313ba1bb74eb48815262
Opcode Fuzzy Hash: 6cbb68f71a8888572499b5677c37180cac2e987cddf84ce317f3d90f50e184a8
Instruction Fuzzy Hash: 8D21F571604204DFEB15DF94D9C0B16BBA9EB84314F24C5ADE9C94F256C336D447CB62

Function 0106D006 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3737109013.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_106d000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dacb0420bb1538a14f30040264b7018b6b7b6ac4a35d6b62ae986f666dea204
Instruction ID: f9d5cb7900624a04ae75e7d1aefbf4cf41cf85f62d6c48463c5bc2ca93abb532
Opcode Fuzzy Hash: 5dacb0420bb1538a14f30040264b7018b6b7b6ac4a35d6b62ae986f666dea204
Instruction Fuzzy Hash: 0B214B715093C09FD703CB64D990B11BFB5AF46214F2985DBD8898F2A7C23A985ACB62

Function 06973C68 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90092534f8f5ae80a6cfcf9d2972aa7f7a8ee019faf8491464e3669bcf970704
Instruction ID: 8a1283bbc830eb23e6aaf1e703707c410c09d4aa80ca79051281c39653171f74
Opcode Fuzzy Hash: 90092534f8f5ae80a6cfcf9d2972aa7f7a8ee019faf8491464e3669bcf970704
Instruction Fuzzy Hash: 76118E32B105284FDF949A79D8146EE7BEAABC8311F148539D406E7748EE24DD029BD0

Function 06973EA3 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e49f467ac0276b2b24c4cc82798cd5a79c8a0519da0ba55c1115ebffa4dc6a91
Instruction ID: 58b4b34ae0da98e2799841d98ec934e95eef1d36034b1fe256f9fbcc10dccaa6
Opcode Fuzzy Hash: e49f467ac0276b2b24c4cc82798cd5a79c8a0519da0ba55c1115ebffa4dc6a91
Instruction Fuzzy Hash: 22012D307042101FEB61963DE810B2BBBDEDFC6350F248469F14ACB785DD65DC469395

Function 0697EE31 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2955f0be7abf066ec20a06ca8fa17dff19442bea838abf7d224db44192acf896
Instruction ID: 17c3f894af965b0cb8a4fa1557d34a3af6a960b4647b50285a4b96c53a1b1979
Opcode Fuzzy Hash: 2955f0be7abf066ec20a06ca8fa17dff19442bea838abf7d224db44192acf896
Instruction Fuzzy Hash: 5B01BC35B102145FCB659A2DA894B2F77DAEFCA714F2088A9F50ACB344EA21DC024396

Function 06973C57 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b927eff60c5dc56a942d918196d02f741224edbc1725974705c28651982d02
Instruction ID: 70e956afeb0f82fe968b3ccb517962d4e3050d55de7e373fc9080e45e298b5d9
Opcode Fuzzy Hash: 71b927eff60c5dc56a942d918196d02f741224edbc1725974705c28651982d02
Instruction Fuzzy Hash: 6101D232B000289BCFA49A7E98216EF7BEAABC8311F18403AD415D7684EF208D0197E1

Function 06973921 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cead6e600c49783a8ee86b8f0bc8e01aae20fefc2e2fc644534a7914b9083a7e
Instruction ID: d0cfcf90bc70acb9b2d31732d31c21bbb1274fbba21080111af185a620c956e9
Opcode Fuzzy Hash: cead6e600c49783a8ee86b8f0bc8e01aae20fefc2e2fc644534a7914b9083a7e
Instruction Fuzzy Hash: FB21F2B5D01219AFCB10DF9AD885ADEFBB8FB48314F50812AE918A3240C7746945CFA5

Function 0697A399 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f9c407a7eb8241e9b527faaa89c00b7e94364660785337d079229c67eed30d
Instruction ID: e64d5326f941c0f53db1989f2df95e4000adc0de0206c7bedbc78a3ba7dc99db
Opcode Fuzzy Hash: 85f9c407a7eb8241e9b527faaa89c00b7e94364660785337d079229c67eed30d
Instruction Fuzzy Hash: 1001B135B145144FCB629A7CF961B1EBBE6EB86210F20842AE10ACB756EE21DC068791

Function 06973928 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58408f2c6ee5fc57ebcfdf66c434ac3939b07f58280ea0bdd45af1a1169cf745
Instruction ID: c90c34608d8e36ee494439956525c71ae0deb7c5dce795b5ac2f57d37638e7d8
Opcode Fuzzy Hash: 58408f2c6ee5fc57ebcfdf66c434ac3939b07f58280ea0bdd45af1a1169cf745
Instruction Fuzzy Hash: 5711C2B5D012199FCB10DF9AD885ADEFBB4FB48310F50812AE918A7240C7746944CFA5

Function 06973EB0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2af0de02cbb8ca42ddd91eda6b71269bd93536789b7473b200781a9915a65b5
Instruction ID: ded7a3b25fb5c7e1d3b6db8f4113796fc46829b11785b689e36a3c188923975c
Opcode Fuzzy Hash: a2af0de02cbb8ca42ddd91eda6b71269bd93536789b7473b200781a9915a65b5
Instruction Fuzzy Hash: 2B01D130B101200FEBA4956EE410B2FB6DBEBC9750F208439F10ACB744DE62DC065385

Function 0697EE40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2a26ecf2e19b62804b747a28b2e1a404b678bdb2ec4a073a59b3d82a30b60b
Instruction ID: 87ac8ae4556dff748d64ae4e4183bfefd6d9423b1418294a5a358d956360acd7
Opcode Fuzzy Hash: fa2a26ecf2e19b62804b747a28b2e1a404b678bdb2ec4a073a59b3d82a30b60b
Instruction Fuzzy Hash: 60018C35B101141FDBA5966DA454B3FB7DBEFC9624F208879F54ACB784EE21DC024385

Function 0697A3A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe0dce4cc50edd3681a3c62edcbd80ac0e6b11cd943a23c9c3caf24cbdef719
Instruction ID: 00dba84ba45f72dbb123044f8ee49aadeb331e8882b9f443600851e51a172570
Opcode Fuzzy Hash: abe0dce4cc50edd3681a3c62edcbd80ac0e6b11cd943a23c9c3caf24cbdef719
Instruction Fuzzy Hash: AB018130B105144FDBA1AA6CE451B1FB7DAEB89315F208429E60ACB748EE61DC065781

Function 0697AFB0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 340f6b5e479e4dcea84b82ad6dea888b2611c7664e5b60d483e7e5debc5720f0
Instruction ID: e989fe323f3a5fcd7bb9aeb5e36991b3231b7595979f34ac1fe50f7a41ec133d
Opcode Fuzzy Hash: 340f6b5e479e4dcea84b82ad6dea888b2611c7664e5b60d483e7e5debc5720f0
Instruction Fuzzy Hash: 8DF0E572E1021C8BDF708A69D844B8EBBBDE745731F20443AE91AE7644D6719C458781

Function 06976111 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fe8932700fa399866108b13482e95e7d67b08547384875631e06c70fad4505
Instruction ID: 607fd34ec7b38915132dfae4baf7b32cfd7eed52dc10d246920393feef53a4f7
Opcode Fuzzy Hash: c9fe8932700fa399866108b13482e95e7d67b08547384875631e06c70fad4505
Instruction Fuzzy Hash: 5FE0D871E141486BDB60CA70CD4979B7A6CD742208F3144B9E404DB102E537C9018751

Function 0697469C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a08ceb9b44f95b06eb38b36cd1741a467b5cd6d81b824df2fae02fc109352c
Instruction ID: 7b93c4b03e7d82dd28c3cf8084f093bad20a3e58052f50b1690df7f9a2652792
Opcode Fuzzy Hash: 65a08ceb9b44f95b06eb38b36cd1741a467b5cd6d81b824df2fae02fc109352c
Instruction Fuzzy Hash: 92E0E570954219DFEB608F94D8597AEBBB1BF49B04F204519E002A6655CBB40941CFC0

Non-executed Functions

Function 06977338 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$q, xrefs: 06977835
$q, xrefs: 0697746C
$q, xrefs: 069778C8
$q, xrefs: 06977829
$q, xrefs: 069778DE
$q, xrefs: 069778D4
$q, xrefs: 0697749D
$q, xrefs: 069778EA
$q, xrefs: 069774A9
$q, xrefs: 06977478

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-1298971921
Opcode ID: 810b728a3f71f8c2aa01b204127fe8330631709dbb6f36e406517e1a4e08f605
Instruction ID: dc3ddc47f7111e7f2ec557c4b60834208eae98bbaff8c2e77b224ca56114d41a
Opcode Fuzzy Hash: 810b728a3f71f8c2aa01b204127fe8330631709dbb6f36e406517e1a4e08f605
Instruction Fuzzy Hash: DE122C30E01619CFDB64DBA9D894B9EB7B6FF88304F208569D44AAB754DB309D85CF80

Function 0697A9C8 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$q, xrefs: 0697AB50
$q, xrefs: 0697AB25
$q, xrefs: 0697AABE
$q, xrefs: 0697AB7A
$q, xrefs: 0697AB86
$q, xrefs: 0697AB19
$q, xrefs: 0697AACA
$q, xrefs: 0697AB44

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: a03facf83764bf37bb4ecab1a00334148ba1f65a17b940bcd7755945081086d8
Instruction ID: 82750cbaf6fac887c4c52fb3fb576d3023bc511e035bef5847935437cc282a7d
Opcode Fuzzy Hash: a03facf83764bf37bb4ecab1a00334148ba1f65a17b940bcd7755945081086d8
Instruction Fuzzy Hash: 00919030E00209DFEF68EB65E945BAE77F6BF84305F248429E8019B784DB74AC45CB90

Function 06976D38 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$q, xrefs: 069771D4
$q, xrefs: 06977240
$q, xrefs: 06977074
$q, xrefs: 0697724C
$q, xrefs: 06977080
$q, xrefs: 0697701A

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 182d83335bba9664e7f11ca7db91a9c6b6f7d9e3fb7842c59df9e7b892f7ca78
Instruction ID: c95374d5d27ea8abf16592c016d30caaa8d8d81474dcad8ac2ca66b5bc636ad2
Opcode Fuzzy Hash: 182d83335bba9664e7f11ca7db91a9c6b6f7d9e3fb7842c59df9e7b892f7ca78
Instruction Fuzzy Hash: 13F15230B00609CFDB59EBA4D590BAEBBB6BF84304F248569E4559F758DB31EC42CB84

Function 06978470 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$q, xrefs: 0697872F
$q, xrefs: 069786D6
$q, xrefs: 0697873B
$q, xrefs: 069786CA

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 1049d230853327435f51d25479237dced8a9cc0068e34d11c5881f8e0dd52a3f
Instruction ID: 4403622512798a8165cd9b3d93dacb9c84a861eadde02553a9285af89d71ce76
Opcode Fuzzy Hash: 1049d230853327435f51d25479237dced8a9cc0068e34d11c5881f8e0dd52a3f
Instruction Fuzzy Hash: 06B14C30F002098FDB64EB65D6946AEB7B6BF84300F248979D456DB794DB75DC82CB80

Function 06978888 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$q, xrefs: 06978913
LRq, xrefs: 0697897B
$q, xrefs: 06978907
LRq, xrefs: 069789CA

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: LRq$LRq$$q$$q
API String ID: 0-2204215535
Opcode ID: 3b5d933fc53e0e3d0ba9b07c30f1a4685af224384d84e7c8c639992d230c8938
Instruction ID: d3620515845cf9ebfc20b9a235b7af6f21950cd9e7e31877b82b48cfd1ac7bcd
Opcode Fuzzy Hash: 3b5d933fc53e0e3d0ba9b07c30f1a4685af224384d84e7c8c639992d230c8938
Instruction Fuzzy Hash: 4351E530B002059FDB58DB28DA44A6AB7F6FF84314F148969E4019FB99EB30EC41CB55

Function 0697AD57 Relevance: 5.2, Strings: 4, Instructions: 159COMMON

Download Yara Rule

Strings

$q, xrefs: 0697AED4
$q, xrefs: 0697AF03
$q, xrefs: 0697AF2C
$q, xrefs: 0697AE81

Memory Dump Source

Source File: 0000000D.00000002.3742178851.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6970000_Quotation.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: e0d9fae6601dcf2ca836587ed266b9d7c2d330f400f2f4cf5316eb158b34d277
Instruction ID: 886c6be6fb135bd3acb3bb6bb07abc36f18201b7e3207e54e20c2d61279c7359
Opcode Fuzzy Hash: e0d9fae6601dcf2ca836587ed266b9d7c2d330f400f2f4cf5316eb158b34d277
Instruction Fuzzy Hash: C151A130E102099FDF65DB68E580AAEB7B6FF84315F24852AE801DBB44DB30EC45CB95

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quotation.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_35nan4xm.0aj.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_seuynxxz.qqt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_umfec4jx.yhu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2huboqp.ffk.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
Quotation.exe

Function 06A034B8 Relevance: 5.6, Strings: 4, Instructions: 562
COMMON

Function 06A02106 Relevance: 1.8, Strings: 1, Instructions: 562
COMMON

Function 06A02C38 Relevance: 7.9, Strings: 6, Instructions: 443
COMMON

Function 0227CFF1 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Function 0227D000 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 06B41164 Relevance: 1.7, APIs: 1, Instructions: 244
processCOMMON

Function 06B41170 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0227AD68 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 0227590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 022744B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 06B40EE0 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Function 06B40EE8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre