Windows Analysis Report
Eschemyquote24573j33.exe

Overview

General Information

Sample name: Eschemyquote24573j33.exe
Analysis ID: 1519249
MD5: bdd152d62cf8fa852e08c46505629663
SHA1: b1a0fd6a26c5bf9ba02c12afcdc89eeb8528040e
SHA256: a2cdc2f4fcad4c6b982674a1b3b86a0f7bcdb7c8f18c1183799d70777c726859
Tags: exeuser-lowmal3
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Contains functionality to register a low level keyboard hook
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Outbound SMTP Connections
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Found malware configuration
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.musabody.com", "Username": "victoria@musabody.com", "Password": "MUSAbody_victoria2018"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe ReversingLabs: Detection: 57%
Multi AV Scanner detection for submitted file
Source: Eschemyquote24573j33.exe ReversingLabs: Detection: 57%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Eschemyquote24573j33.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Eschemyquote24573j33.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Eschemyquote24573j33.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: BXgJ.pdb source: Eschemyquote24573j33.exe, ctsdvwT.exe.4.dr
Source: Binary string: BXgJ.pdbSHA256+ source: Eschemyquote24573j33.exe, ctsdvwT.exe.4.dr
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4x nop then jmp 06F8A50Bh 0_2_06F89A6C
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 4x nop then jmp 0708A1DBh 7_2_0708973C
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 4x nop then jmp 07A5A1E3h 10_2_07A59744

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:49716 -> 108.167.140.123:587
Source: Network traffic Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.5:49716 -> 108.167.140.123:587
Source: Network traffic Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.5:49716 -> 108.167.140.123:587
Source: Network traffic Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.5:49716 -> 108.167.140.123:587
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 108.167.140.123:587
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 108.167.140.123 108.167.140.123
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 108.167.140.123:587
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: mail.musabody.com
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003389000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.musabody.com
Source: Eschemyquote24573j33.exe, 00000000.00000002.2068800637.0000000002966000.00000004.00000800.00020000.00000000.sdmp, ctsdvwT.exe, 00000007.00000002.2195768710.0000000002CFF000.00000004.00000800.00020000.00000000.sdmp, ctsdvwT.exe, 0000000A.00000002.2276352451.0000000002EA9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Eschemyquote24573j33.exe, 00000000.00000002.2069428436.0000000003909000.00000004.00000800.00020000.00000000.sdmp, ctsdvwT.exe, 00000008.00000002.2255456964.0000000000402000.00000040.00000400.00020000.00000000.sdmp, ctsdvwT.exe, 0000000A.00000002.2283120210.0000000004071000.00000004.00000800.00020000.00000000.sdmp, ctsdvwT.exe, 0000000A.00000002.2283120210.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, POq2Ux.cs .Net Code: _4H57oeN1J
Source: 0.2.Eschemyquote24573j33.exe.39cb710.3.raw.unpack, POq2Ux.cs .Net Code: _4H57oeN1J
Contains functionality to register a low level keyboard hook
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_0693EE20 SetWindowsHookExA 0000000D,00000000,?,?,?,?,?,?,?,?,?,0693FC90,00000000,00000000 4_2_0693EE20
Installs a global keyboard hook
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Eschemyquote24573j33.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Window created: window name: CLIPBRDWNDCLASS

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8.2.ctsdvwT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.ctsdvwT.exe.3f0d1a8.3.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.ctsdvwT.exe.4071760.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.ctsdvwT.exe.4071760.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Eschemyquote24573j33.exe.39cb710.3.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.ctsdvwT.exe.3f0d1a8.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Eschemyquote24573j33.exe.39cb710.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_0275DEEC 0_2_0275DEEC
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F81DB8 0_2_06F81DB8
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F86CB0 0_2_06F86CB0
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F81DA8 0_2_06F81DA8
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F84D30 0_2_06F84D30
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F8C2A8 0_2_06F8C2A8
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F848F8 0_2_06F848F8
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F848F8 0_2_06F848F8
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F848E0 0_2_06F848E0
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F871C0 0_2_06F871C0
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F85168 0_2_06F85168
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_032B9758 4_2_032B9758
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_032B4AA8 4_2_032B4AA8
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_032BC9D8 4_2_032BC9D8
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_032B8F90 4_2_032B8F90
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_032B3E90 4_2_032B3E90
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_032B41D8 4_2_032B41D8
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_06936C74 4_2_06936C74
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_06932D98 4_2_06932D98
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_06930848 4_2_06930848
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_069326B0 4_2_069326B0
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_06938C96 4_2_06938C96
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_06936C68 4_2_06936C68
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_06937FA6 4_2_06937FA6
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 4_2_06937FA8 4_2_06937FA8
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_012CDEEC 7_2_012CDEEC
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_07081DB8 7_2_07081DB8
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_0708BF80 7_2_0708BF80
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_07084D30 7_2_07084D30
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_07081D79 7_2_07081D79
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_07086CB0 7_2_07086CB0
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_07085168 7_2_07085168
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_070871C0 7_2_070871C0
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_070848E0 7_2_070848E0
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_070848F8 7_2_070848F8
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_01879638 8_2_01879638
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_0187C980 8_2_0187C980
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_01874AA8 8_2_01874AA8
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_01873E90 8_2_01873E90
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_018741D8 8_2_018741D8
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_06860448 8_2_06860448
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_068611F0 8_2_068611F0
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_06866C6C 8_2_06866C6C
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_06862D98 8_2_06862D98
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_068622B0 8_2_068622B0
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_06867F81 8_2_06867F81
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_06867FA8 8_2_06867FA8
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_06868C97 8_2_06868C97
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 8_2_0187CC68 8_2_0187CC68
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 10_2_013DDEEC 10_2_013DDEEC
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 10_2_07A51DB8 10_2_07A51DB8
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 10_2_07A5BF80 10_2_07A5BF80
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 10_2_07A51DA8 10_2_07A51DA8
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 10_2_07A54D30 10_2_07A54D30
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 10_2_07A51D79 10_2_07A51D79
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 10_2_07A56CB0 10_2_07A56CB0
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 10_2_07A571C0 10_2_07A571C0
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 10_2_07A55168 10_2_07A55168
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 10_2_07A548F8 10_2_07A548F8
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 11_2_01819638 11_2_01819638
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 11_2_0181C980 11_2_0181C980
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 11_2_01814AA8 11_2_01814AA8
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 11_2_01813E90 11_2_01813E90
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 11_2_018141D8 11_2_018141D8
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 11_2_0181CC68 11_2_0181CC68
Sample file is different than original file name gathered from version info
Source: Eschemyquote24573j33.exe, 00000000.00000002.2069428436.0000000003909000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename24eacbb4-825a-4768-ad59-21c6c6ffb60d.exe4 vs Eschemyquote24573j33.exe
Source: Eschemyquote24573j33.exe, 00000000.00000002.2069428436.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Eschemyquote24573j33.exe
Source: Eschemyquote24573j33.exe, 00000000.00000002.2068800637.00000000029B5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename24eacbb4-825a-4768-ad59-21c6c6ffb60d.exe4 vs Eschemyquote24573j33.exe
Source: Eschemyquote24573j33.exe, 00000000.00000000.2032928595.0000000000536000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameBXgJ.exe> vs Eschemyquote24573j33.exe
Source: Eschemyquote24573j33.exe, 00000000.00000002.2066084246.000000000093E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Eschemyquote24573j33.exe
Source: Eschemyquote24573j33.exe, 00000000.00000002.2072001901.0000000007280000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Eschemyquote24573j33.exe
Source: Eschemyquote24573j33.exe, 00000004.00000002.4505813523.00000000011D9000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Eschemyquote24573j33.exe
Source: Eschemyquote24573j33.exe Binary or memory string: OriginalFilenameBXgJ.exe> vs Eschemyquote24573j33.exe
Uses 32bit PE files
Source: Eschemyquote24573j33.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 8.2.ctsdvwT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.ctsdvwT.exe.3f0d1a8.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.ctsdvwT.exe.4071760.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.ctsdvwT.exe.4071760.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Eschemyquote24573j33.exe.39cb710.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.ctsdvwT.exe.3f0d1a8.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Eschemyquote24573j33.exe.39cb710.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: Eschemyquote24573j33.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, ZTFEpdjP8zw.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, WnRNxU.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, 2njIk.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, I5ElxL.cs Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, QQSiOsa4hPS.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, FdHU4eb83Z7.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, 3VzYbXLJt4.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, 3VzYbXLJt4.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, 3VzYbXLJt4.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, 3VzYbXLJt4.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, PrUsrswPYsf1O0VuSQ.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, gCdcqLt9S80SxXohl8.cs Security API names: _0020.SetAccessControl
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, gCdcqLt9S80SxXohl8.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, gCdcqLt9S80SxXohl8.cs Security API names: _0020.AddAccessRule
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, PrUsrswPYsf1O0VuSQ.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, gCdcqLt9S80SxXohl8.cs Security API names: _0020.SetAccessControl
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, gCdcqLt9S80SxXohl8.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, gCdcqLt9S80SxXohl8.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@13/9@1/1
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Eschemyquote24573j33.exe.log Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Mutant created: \Sessions\1\BaseNamedObjects\PIcecqLkKY
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2cycmogx.s02.ps1 Jump to behavior
Source: Eschemyquote24573j33.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Eschemyquote24573j33.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.00000000033E6000.00000004.00000800.00020000.00000000.sdmp, Eschemyquote24573j33.exe, 00000004.00000002.4509927352.00000000033F9000.00000004.00000800.00020000.00000000.sdmp, ctsdvwT.exe, 00000008.00000002.2259031078.0000000003478000.00000004.00000800.00020000.00000000.sdmp, ctsdvwT.exe, 00000008.00000002.2259031078.0000000003465000.00000004.00000800.00020000.00000000.sdmp, ctsdvwT.exe, 0000000B.00000002.4509557072.0000000003265000.00000004.00000800.00020000.00000000.sdmp, ctsdvwT.exe, 0000000B.00000002.4509557072.0000000003278000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Eschemyquote24573j33.exe ReversingLabs: Detection: 57%
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe File read: C:\Users\user\Desktop\Eschemyquote24573j33.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Eschemyquote24573j33.exe "C:\Users\user\Desktop\Eschemyquote24573j33.exe"
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Eschemyquote24573j33.exe"
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process created: C:\Users\user\Desktop\Eschemyquote24573j33.exe "C:\Users\user\Desktop\Eschemyquote24573j33.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown Process created: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe "C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe"
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process created: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe "C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe "C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe"
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process created: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe "C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe"
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Eschemyquote24573j33.exe" Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process created: C:\Users\user\Desktop\Eschemyquote24573j33.exe "C:\Users\user\Desktop\Eschemyquote24573j33.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process created: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe "C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process created: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe "C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe" Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Section loaded: edputil.dll
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: Eschemyquote24573j33.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Eschemyquote24573j33.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Eschemyquote24573j33.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: BXgJ.pdb source: Eschemyquote24573j33.exe, ctsdvwT.exe.4.dr
Source: Binary string: BXgJ.pdbSHA256+ source: Eschemyquote24573j33.exe, ctsdvwT.exe.4.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: Eschemyquote24573j33.exe, MainForm.cs .Net Code: InitializeComponent
Source: 0.2.Eschemyquote24573j33.exe.293d9d8.1.raw.unpack, QBy45BY4uMbUQs88Qq.cs .Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Eschemyquote24573j33.exe.5490000.5.raw.unpack, QBy45BY4uMbUQs88Qq.cs .Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, gCdcqLt9S80SxXohl8.cs .Net Code: EAPqyhE53x System.Reflection.Assembly.Load(byte[])
Source: 0.2.Eschemyquote24573j33.exe.294a200.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs .Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, gCdcqLt9S80SxXohl8.cs .Net Code: EAPqyhE53x System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: Eschemyquote24573j33.exe Static PE information: 0xDA4BC7FC [Sun Jan 20 21:11:24 2086 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_04DD1760 pushfd ; iretd 0_2_04DD176E
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_04DDDDB0 push eax; mov dword ptr [esp], ecx 0_2_04DDDDC4
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F83F81 push E406F3A8h; retf 0_2_06F83F8D
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Code function: 0_2_06F81408 push es; iretd 0_2_06F81414
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_0526DDB0 push eax; mov dword ptr [esp], ecx 7_2_0526DDC4
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 7_2_07083F81 push E40703A8h; retf 7_2_07083F8D
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Code function: 10_2_07A53F81 push E40747A8h; retf 10_2_07A53F8D
Source: Eschemyquote24573j33.exe Static PE information: section name: .text entropy: 7.8248096934652995
Source: 0.2.Eschemyquote24573j33.exe.293d9d8.1.raw.unpack, kD0JNdgNBriBGn5egS.cs High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Eschemyquote24573j33.exe.293d9d8.1.raw.unpack, QBy45BY4uMbUQs88Qq.cs High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Eschemyquote24573j33.exe.5490000.5.raw.unpack, kD0JNdgNBriBGn5egS.cs High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Eschemyquote24573j33.exe.5490000.5.raw.unpack, QBy45BY4uMbUQs88Qq.cs High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, UlyEHKDV3LaCLLom7F.cs High entropy of concatenated method names: 'pH1nT0iaOY', 'FQNnEB4jwZ', 'hMWnUogfXy', 'QLYUxgPJ8s', 'oF7Uz4tlBf', 'K19nKoUx7B', 'A5tnNZEGNZ', 'PDNnZa4gaA', 'AC4nu0RQSL', 'nQhnqmZFJZ'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, hIgUhVm92GZDPRtBZs.cs High entropy of concatenated method names: 'aEerNH6Pee', 'e1Crux6uG0', 'T7rrqU0eyk', 's7HrTZ4tfw', 'mCDrJsHC5n', 'oL5rBfBvT2', 'DDnrU9fksV', 'YkD8Vr7oxG', 'uLP8AV5rwc', 'afE8iWwyid'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, tnUsWDzA62wbjJK7EM.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sQUr2Tcm5c', 'a9Zre2D0PL', 'Ue7rbCnods', 'pgwr5oOjgu', 'x4Rr8D34RW', 'lA6rrDWMI5', 'EXprOhZX7I'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, VWsQCrlF0Gyb1uODge.cs High entropy of concatenated method names: 'eDv8TU0X3D', 'NDL8JxENm7', 'Q5X8EvdfPD', 'T0s8BeLCP7', 'yn48UXqALy', 'q578n3f8YE', 'msO83F7Vj0', 'tTb8GM1mb9', 's4y8tMaySv', 'Mub80LT52g'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, Kr6tTfhpAfgPwUsiHt.cs High entropy of concatenated method names: 'Dispose', 'oOrNiYOKbf', 'w8MZm4XS2y', 'SrxDD81xHF', 's86NxNKYLD', 'QJLNzjicse', 'ProcessDialogKey', 'E9lZKtXedb', 'CWGZNT5rxG', 'CQwZZelvbL'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, xGr7Z2GEn7B188JC2j.cs High entropy of concatenated method names: 'qii5AAueNq', 'fyX5xHhgZc', 'gI88Kh75ro', 'obf8N2wUcD', 'Djh59XZles', 'tmg5c3xJun', 'a7p5gweeln', 'TOX54Pe9Rk', 'aAF5H2EGrx', 'p2q5L91nxg'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, VY8MeekEpUrCIR70BG.cs High entropy of concatenated method names: 'dTkEko97C5', 'YjOEFhMteY', 'nuDEjSZtYX', 'vmoERBXiTG', 'OnMEe9baGO', 'wDCEbEucwY', 'oDwE59Wkda', 'rQIE8lH3JX', 'voQErBa3bM', 'iEoEOMMKqC'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, HABTMne0v4CLRfMopA9.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'C8rO44BB6u', 'hNyOHjeFHF', 'QxBOLoQMGh', 'fwbOvdv3f2', 'E47OQAiiwx', 'iYsOap421y', 'lXKOVFcXrV'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, PrUsrswPYsf1O0VuSQ.cs High entropy of concatenated method names: 'H4AJ4j3ilH', 'wsyJH4d698', 'MJaJLoZ7oY', 'RUlJvFRcV4', 'a5LJQ2g69H', 'FYtJad7KGm', 'X6AJVn4jSw', 'owoJAltLbl', 'GAVJitwjyS', 'hXXJx4GMn2'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, Y4AIJCVq0AJhyrGakh.cs High entropy of concatenated method names: 'WSe8SZ3YF4', 'pti8mWX9em', 'vmZ8oqtDPE', 'hkb8WUToAC', 'A7f84TLLCY', 'xxe8ItRbog', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, xeO7gIW6JJoYZalNAu.cs High entropy of concatenated method names: 'SHqnX5xpDD', 'yrqn6UQZpy', 'n99nyv3JvF', 'Tcknk910Ni', 'O23nl1DQiq', 'jvcnFbBPgv', 'TEFnCUUSFt', 'yFsnjrQFDE', 'Qb4nRV0JWX', 'QuRnMayd87'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, EeXc16K8feKegOUF9O.cs High entropy of concatenated method names: 'zDwuy78Yq0GHpy02baO', 'NmcrW48t4xKZ5ETtqDB', 'BUkU83I4oM', 'v6iUrbcFMe', 'vd1UO1sF6l', 'tHtWgg85kIrTrMFsJv8', 'ycINcn8bJuHIaQB7d7P', 'tu0PNV8gRkNd9YOnaqE'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, vwPnnh1JETgPmNWxFh.cs High entropy of concatenated method names: 'kH4ePI6d2w', 'ay0ec9sgde', 'SNee47thXv', 'AFIeHMbpLT', 'MIGemZPTPT', 'HbaeomHW6J', 'JiheWL44nK', 'sMIeIQeG1N', 'NGNeYJvkHT', 'EonepykAOn'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, QsbL7G6byXSclr7ntR.cs High entropy of concatenated method names: 'QfYULBZAOE', 'JSeUv4Q8OK', 'RO9UQXHnKs', 'ToString', 'XkeUad4Yfw', 'ww3UVnAuxM', 'Jlry9P8avPvmYsH7kUq', 'dy0Uir8T4B5SaJE8191', 'r6TWWP8JqsdkxTFhbjw'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, eFbwqseeQJnslq7RDgX.cs High entropy of concatenated method names: 'ToString', 'w0XOuNICc3', 'vaYOqyDgBe', 'uGsO76rLOm', 'FbWOTpEQsy', 'pwnOJg8t70', 'HPTOEMocDL', 'Ls6OBaQNJ6', 'rFuI4lPxwIXkR6VXplG', 'dBSTwmPzi37Np5amv94'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, CqTErPPhFYaD5LQ6TP.cs High entropy of concatenated method names: 'Jow5tRMrIr', 'Vtv50UEnKd', 'ToString', 'Gdc5T8eOtd', 'wmD5JYZ9Mb', 'Tmc5ELEpAl', 'kP85BUIDcQ', 'mRM5U9C0JV', 'DLQ5n7X5PC', 'McY53TyA3C'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, j21in5yVGLEM0360j8.cs High entropy of concatenated method names: 'YRDy0WrpK', 'OFKkwQgS6', 'D1WFyGTfI', 'uyhCYjXJd', 'pefRGc0xX', 'R1KMFsmYJ', 'B8fO809gmGgQfT5aPE', 'zoA9UYo7AbkpggaFK3', 'Kgk80KIK7', 'udbOphJqA'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, avfUgueg8O5E6WTR2iN.cs High entropy of concatenated method names: 'BpBrXXR2M4', 'RhRr6TWPjl', 'DHNryoIfBm', 'pfMrk24MPn', 'qpLrlQWCEY', 'Po3rFs8tOC', 'r3drClycdm', 'AWSrj2L4Uc', 'YbcrR9igfL', 'eHurMZK3BD'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, rU56x3nqyE643hqfjy.cs High entropy of concatenated method names: 'c1tNnpXhbH', 'BY7N3v2ENh', 'zbXNtVusxl', 'QkFN0obkx7', 'OJtNeykL8l', 'JEoNbGhgmY', 'dEYJCHOKfVpcG0Jrj0', 'NQMJjLCg17Zx2MEfFZ', 'JuONNYxWhK', 'kqrNuqy96l'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, gCdcqLt9S80SxXohl8.cs High entropy of concatenated method names: 'AgRu7nhUWk', 'wRjuT4t5cw', 'dA4uJgP0jn', 'PvBuEF6J5y', 'hMUuBJREL1', 'TC8uUdeWId', 'xuMunQ3nuC', 'fnVu3lbXy4', 'JFAuGsjecx', 'eZuutf5CAm'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, xjvwbyYXDQ5yAjhT6V.cs High entropy of concatenated method names: 'V0lU7xy1FK', 'cCZUJHX0UM', 'QSVUBheX0a', 'QPvUn9643w', 'GVXU3NTAQQ', 'FpPBQDOw1G', 'wwhBamCGe5', 'CTFBVubfLs', 't3EBAr5mM0', 'qKQBiHwCXB'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, BTh9fEIFxhSR4C1soA.cs High entropy of concatenated method names: 'SmBBlEdGPT', 'G7eBCM0fR8', 'BCVEoGaeYq', 'aTHEWbCyi6', 'dtoEIb9ClA', 'YIdEY4VDHh', 'GsBEpDQwWN', 'HKZEfgfWTE', 'CKuE1flDgy', 'J2SEPZcBMJ'
Source: 0.2.Eschemyquote24573j33.exe.7280000.6.raw.unpack, w58GgSNlKHJbjw5uF2.cs High entropy of concatenated method names: 'hQH2jBR4nH', 'WvX2RysMVl', 'nP82SQiyvk', 'VkW2mHNm9Z', 'rG62Wo6ihd', 'GIv2IlFp7p', 'K0A2peOJ1x', 'naR2fToKUU', 'xL12Pu8ELL', 'QwX29cMNHU'
Source: 0.2.Eschemyquote24573j33.exe.294a200.0.raw.unpack, kD0JNdgNBriBGn5egS.cs High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Eschemyquote24573j33.exe.294a200.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, UlyEHKDV3LaCLLom7F.cs High entropy of concatenated method names: 'pH1nT0iaOY', 'FQNnEB4jwZ', 'hMWnUogfXy', 'QLYUxgPJ8s', 'oF7Uz4tlBf', 'K19nKoUx7B', 'A5tnNZEGNZ', 'PDNnZa4gaA', 'AC4nu0RQSL', 'nQhnqmZFJZ'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, hIgUhVm92GZDPRtBZs.cs High entropy of concatenated method names: 'aEerNH6Pee', 'e1Crux6uG0', 'T7rrqU0eyk', 's7HrTZ4tfw', 'mCDrJsHC5n', 'oL5rBfBvT2', 'DDnrU9fksV', 'YkD8Vr7oxG', 'uLP8AV5rwc', 'afE8iWwyid'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, tnUsWDzA62wbjJK7EM.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sQUr2Tcm5c', 'a9Zre2D0PL', 'Ue7rbCnods', 'pgwr5oOjgu', 'x4Rr8D34RW', 'lA6rrDWMI5', 'EXprOhZX7I'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, VWsQCrlF0Gyb1uODge.cs High entropy of concatenated method names: 'eDv8TU0X3D', 'NDL8JxENm7', 'Q5X8EvdfPD', 'T0s8BeLCP7', 'yn48UXqALy', 'q578n3f8YE', 'msO83F7Vj0', 'tTb8GM1mb9', 's4y8tMaySv', 'Mub80LT52g'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, Kr6tTfhpAfgPwUsiHt.cs High entropy of concatenated method names: 'Dispose', 'oOrNiYOKbf', 'w8MZm4XS2y', 'SrxDD81xHF', 's86NxNKYLD', 'QJLNzjicse', 'ProcessDialogKey', 'E9lZKtXedb', 'CWGZNT5rxG', 'CQwZZelvbL'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, xGr7Z2GEn7B188JC2j.cs High entropy of concatenated method names: 'qii5AAueNq', 'fyX5xHhgZc', 'gI88Kh75ro', 'obf8N2wUcD', 'Djh59XZles', 'tmg5c3xJun', 'a7p5gweeln', 'TOX54Pe9Rk', 'aAF5H2EGrx', 'p2q5L91nxg'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, VY8MeekEpUrCIR70BG.cs High entropy of concatenated method names: 'dTkEko97C5', 'YjOEFhMteY', 'nuDEjSZtYX', 'vmoERBXiTG', 'OnMEe9baGO', 'wDCEbEucwY', 'oDwE59Wkda', 'rQIE8lH3JX', 'voQErBa3bM', 'iEoEOMMKqC'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, HABTMne0v4CLRfMopA9.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'C8rO44BB6u', 'hNyOHjeFHF', 'QxBOLoQMGh', 'fwbOvdv3f2', 'E47OQAiiwx', 'iYsOap421y', 'lXKOVFcXrV'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, PrUsrswPYsf1O0VuSQ.cs High entropy of concatenated method names: 'H4AJ4j3ilH', 'wsyJH4d698', 'MJaJLoZ7oY', 'RUlJvFRcV4', 'a5LJQ2g69H', 'FYtJad7KGm', 'X6AJVn4jSw', 'owoJAltLbl', 'GAVJitwjyS', 'hXXJx4GMn2'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, Y4AIJCVq0AJhyrGakh.cs High entropy of concatenated method names: 'WSe8SZ3YF4', 'pti8mWX9em', 'vmZ8oqtDPE', 'hkb8WUToAC', 'A7f84TLLCY', 'xxe8ItRbog', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, xeO7gIW6JJoYZalNAu.cs High entropy of concatenated method names: 'SHqnX5xpDD', 'yrqn6UQZpy', 'n99nyv3JvF', 'Tcknk910Ni', 'O23nl1DQiq', 'jvcnFbBPgv', 'TEFnCUUSFt', 'yFsnjrQFDE', 'Qb4nRV0JWX', 'QuRnMayd87'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, EeXc16K8feKegOUF9O.cs High entropy of concatenated method names: 'zDwuy78Yq0GHpy02baO', 'NmcrW48t4xKZ5ETtqDB', 'BUkU83I4oM', 'v6iUrbcFMe', 'vd1UO1sF6l', 'tHtWgg85kIrTrMFsJv8', 'ycINcn8bJuHIaQB7d7P', 'tu0PNV8gRkNd9YOnaqE'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, vwPnnh1JETgPmNWxFh.cs High entropy of concatenated method names: 'kH4ePI6d2w', 'ay0ec9sgde', 'SNee47thXv', 'AFIeHMbpLT', 'MIGemZPTPT', 'HbaeomHW6J', 'JiheWL44nK', 'sMIeIQeG1N', 'NGNeYJvkHT', 'EonepykAOn'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, QsbL7G6byXSclr7ntR.cs High entropy of concatenated method names: 'QfYULBZAOE', 'JSeUv4Q8OK', 'RO9UQXHnKs', 'ToString', 'XkeUad4Yfw', 'ww3UVnAuxM', 'Jlry9P8avPvmYsH7kUq', 'dy0Uir8T4B5SaJE8191', 'r6TWWP8JqsdkxTFhbjw'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, eFbwqseeQJnslq7RDgX.cs High entropy of concatenated method names: 'ToString', 'w0XOuNICc3', 'vaYOqyDgBe', 'uGsO76rLOm', 'FbWOTpEQsy', 'pwnOJg8t70', 'HPTOEMocDL', 'Ls6OBaQNJ6', 'rFuI4lPxwIXkR6VXplG', 'dBSTwmPzi37Np5amv94'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, CqTErPPhFYaD5LQ6TP.cs High entropy of concatenated method names: 'Jow5tRMrIr', 'Vtv50UEnKd', 'ToString', 'Gdc5T8eOtd', 'wmD5JYZ9Mb', 'Tmc5ELEpAl', 'kP85BUIDcQ', 'mRM5U9C0JV', 'DLQ5n7X5PC', 'McY53TyA3C'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, j21in5yVGLEM0360j8.cs High entropy of concatenated method names: 'YRDy0WrpK', 'OFKkwQgS6', 'D1WFyGTfI', 'uyhCYjXJd', 'pefRGc0xX', 'R1KMFsmYJ', 'B8fO809gmGgQfT5aPE', 'zoA9UYo7AbkpggaFK3', 'Kgk80KIK7', 'udbOphJqA'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, avfUgueg8O5E6WTR2iN.cs High entropy of concatenated method names: 'BpBrXXR2M4', 'RhRr6TWPjl', 'DHNryoIfBm', 'pfMrk24MPn', 'qpLrlQWCEY', 'Po3rFs8tOC', 'r3drClycdm', 'AWSrj2L4Uc', 'YbcrR9igfL', 'eHurMZK3BD'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, rU56x3nqyE643hqfjy.cs High entropy of concatenated method names: 'c1tNnpXhbH', 'BY7N3v2ENh', 'zbXNtVusxl', 'QkFN0obkx7', 'OJtNeykL8l', 'JEoNbGhgmY', 'dEYJCHOKfVpcG0Jrj0', 'NQMJjLCg17Zx2MEfFZ', 'JuONNYxWhK', 'kqrNuqy96l'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, gCdcqLt9S80SxXohl8.cs High entropy of concatenated method names: 'AgRu7nhUWk', 'wRjuT4t5cw', 'dA4uJgP0jn', 'PvBuEF6J5y', 'hMUuBJREL1', 'TC8uUdeWId', 'xuMunQ3nuC', 'fnVu3lbXy4', 'JFAuGsjecx', 'eZuutf5CAm'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, xjvwbyYXDQ5yAjhT6V.cs High entropy of concatenated method names: 'V0lU7xy1FK', 'cCZUJHX0UM', 'QSVUBheX0a', 'QPvUn9643w', 'GVXU3NTAQQ', 'FpPBQDOw1G', 'wwhBamCGe5', 'CTFBVubfLs', 't3EBAr5mM0', 'qKQBiHwCXB'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, BTh9fEIFxhSR4C1soA.cs High entropy of concatenated method names: 'SmBBlEdGPT', 'G7eBCM0fR8', 'BCVEoGaeYq', 'aTHEWbCyi6', 'dtoEIb9ClA', 'YIdEY4VDHh', 'GsBEpDQwWN', 'HKZEfgfWTE', 'CKuE1flDgy', 'J2SEPZcBMJ'
Source: 0.2.Eschemyquote24573j33.exe.3b8df60.2.raw.unpack, w58GgSNlKHJbjw5uF2.cs High entropy of concatenated method names: 'hQH2jBR4nH', 'WvX2RysMVl', 'nP82SQiyvk', 'VkW2mHNm9Z', 'rG62Wo6ihd', 'GIv2IlFp7p', 'K0A2peOJ1x', 'naR2fToKUU', 'xL12Pu8ELL', 'QwX29cMNHU'
Drops PE files
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe File created: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Jump to dropped file
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ctsdvwT Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ctsdvwT Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe File opened: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe:Zone.Identifier read attributes | delete Jump to behavior
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Eschemyquote24573j33.exe PID: 4332, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctsdvwT.exe PID: 7104, type: MEMORYSTR
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory allocated: 2750000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory allocated: 2900000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory allocated: 2770000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory allocated: 7AB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory allocated: 8AB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory allocated: 8C70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory allocated: 9C70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory allocated: 3270000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory allocated: 3310000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory allocated: 5310000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 1280000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 2C90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 2AB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 79E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 89E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 8B90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 9B90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 1870000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 3390000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 31A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 13C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 2E40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 2B90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 7BA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 8BA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 8D50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 9D50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 1810000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 3190000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory allocated: 5190000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2400000 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399875 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399765 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399654 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399546 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399431 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399327 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399216 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399109 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399000 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398890 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398780 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398671 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398562 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398451 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398343 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398234 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398125 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397955 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397750 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397637 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397529 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397389 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397281 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397171 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397059 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396953 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396843 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396734 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396625 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396515 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396406 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396296 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396187 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396078 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395968 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395859 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395750 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395640 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395531 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395421 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395282 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395164 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395052 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394937 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394828 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394718 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394607 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394500 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394390 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394281 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2400000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399874 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399766 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399656 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399547 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399437 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399328 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399219 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398911 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398754 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398641 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398516 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398406 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398296 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398187 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398077 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397969 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397859 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397750 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397637 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397531 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397416 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397312 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397203 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396984 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396875 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396766 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396656 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396547 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396437 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396328 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396218 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396109 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395891 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395781 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395672 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395557 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395453 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395343 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395234 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395125 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395016 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394906 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394797 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394683 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394574 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394468 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394359 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394245 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2400000
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399890
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399765
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399656
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399546
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399403
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399296
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399185
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399077
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398969
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398859
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398750
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398640
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398530
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398422
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398312
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398201
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398093
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397984
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397875
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397765
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397656
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397547
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397435
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397328
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397218
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397104
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397000
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396845
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396719
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396594
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396481
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396375
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396258
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396156
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396047
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395937
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395828
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395719
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395594
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395484
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395375
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395266
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395156
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395047
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394937
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394828
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394719
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394609
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394500
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394391
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6314 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3398 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Window / User API: threadDelayed 3470 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Window / User API: threadDelayed 6380 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Window / User API: threadDelayed 3249 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Window / User API: threadDelayed 6607 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Window / User API: threadDelayed 4657
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Window / User API: threadDelayed 5193
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 3948 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2672 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep count: 38 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -35048813740048126s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2400000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 3176 Thread sleep count: 3470 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2399875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 3176 Thread sleep count: 6380 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2399765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2399654s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2399546s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2399431s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2399327s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2399216s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2399109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2399000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2398890s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2398780s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2398671s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2398562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2398451s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2398343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2398234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2398125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2397955s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2397750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2397637s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2397529s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2397389s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2397281s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2397171s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2397059s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2396953s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2396843s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2396734s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2396625s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2396515s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2396406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2396296s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2396187s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2396078s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2395968s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2395859s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2395750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2395640s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2395531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2395421s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2395282s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2395164s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2395052s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2394937s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2394828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2394718s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2394607s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2394500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2394390s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe TID: 940 Thread sleep time: -2394281s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5500 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep count: 38 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -35048813740048126s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2400000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2399874s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 6772 Thread sleep count: 3249 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 6772 Thread sleep count: 6607 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2399766s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2399656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2399547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2399437s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2399328s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2399219s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2398911s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2398754s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2398641s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2398516s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2398406s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2398296s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2398187s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2398077s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2397969s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2397859s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2397750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2397637s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2397531s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2397416s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2397312s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2397203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2397093s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2396984s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2396875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2396766s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2396656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2396547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2396437s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2396328s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2396218s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2396109s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2396000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2395891s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2395781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2395672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2395557s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2395453s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2395343s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2395234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2395125s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2395016s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2394906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2394797s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2394683s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2394574s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2394468s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2394359s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 4668 Thread sleep time: -2394245s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 3576 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -34126476536362649s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2400000s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5832 Thread sleep count: 4657 > 30
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2399890s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2399765s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2399656s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5832 Thread sleep count: 5193 > 30
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2399546s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2399403s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2399296s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2399185s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2399077s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2398969s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2398859s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2398750s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2398640s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2398530s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2398422s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2398312s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2398201s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2398093s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2397984s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2397875s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2397765s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2397656s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2397547s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2397435s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2397328s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2397218s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2397104s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2397000s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2396845s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2396719s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2396594s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2396481s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2396375s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2396258s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2396156s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2396047s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2395937s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2395828s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2395719s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2395594s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2395484s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2395375s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2395266s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2395156s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2395047s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2394937s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2394828s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2394719s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2394609s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2394500s >= -30000s
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe TID: 5452 Thread sleep time: -2394391s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2400000 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399875 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399765 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399654 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399546 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399431 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399327 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399216 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399109 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2399000 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398890 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398780 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398671 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398562 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398451 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398343 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398234 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2398125 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397955 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397750 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397637 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397529 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397389 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397281 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397171 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2397059 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396953 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396843 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396734 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396625 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396515 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396406 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396296 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396187 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2396078 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395968 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395859 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395750 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395640 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395531 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395421 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395282 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395164 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2395052 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394937 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394828 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394718 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394607 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394500 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394390 Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Thread delayed: delay time: 2394281 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2400000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399874 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399766 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399656 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399547 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399437 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399328 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399219 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398911 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398754 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398641 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398516 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398406 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398296 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398187 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398077 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397969 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397859 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397750 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397637 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397531 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397416 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397312 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397203 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396984 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396875 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396766 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396656 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396547 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396437 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396328 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396218 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396109 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395891 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395781 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395672 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395557 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395453 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395343 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395234 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395125 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395016 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394906 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394797 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394683 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394574 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394468 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394359 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394245 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2400000
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399890
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399765
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399656
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399546
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399403
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399296
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399185
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2399077
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398969
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398859
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398750
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398640
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398530
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398422
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398312
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398201
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2398093
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397984
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397875
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397765
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397656
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397547
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397435
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397328
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397218
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397104
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2397000
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396845
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396719
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396594
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396481
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396375
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396258
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396156
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2396047
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395937
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395828
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395719
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395594
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395484
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395375
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395266
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395156
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2395047
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394937
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394828
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394719
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394609
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394500
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Thread delayed: delay time: 2394391
Source: Eschemyquote24573j33.exe, 00000000.00000002.2066235627.0000000000973000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\xE
Source: Eschemyquote24573j33.exe, 00000004.00000002.4513394772.0000000006830000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Eschemyquote24573j33.exe"
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Eschemyquote24573j33.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Memory written: C:\Users\user\Desktop\Eschemyquote24573j33.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory written: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Memory written: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Eschemyquote24573j33.exe" Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Process created: C:\Users\user\Desktop\Eschemyquote24573j33.exe "C:\Users\user\Desktop\Eschemyquote24573j33.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process created: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe "C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Process created: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe "C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe" Jump to behavior
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003311000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $]q?<b>[ Program Manager]</b> (26/09/2024 17:46:33)<br>{Win}r{Win}rTHbq@N7
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003311000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program ManagerLR]q<
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003311000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003311000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $]q8<b>[ Program Manager]</b> (26/09/2024 17:46:33)<br>{Win}THbq@N7
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003389000.00000004.00000800.00020000.00000000.sdmp, Eschemyquote24573j33.exe, 00000004.00000002.4509927352.000000000337D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Time: 11/19/2024 17:45:25<br>User Name: user<br>Computer Name: 134349<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br><hr><b>[ Program Manager]</b> (26/09/2024 17:46:33)<br>{Win}r{Win}r
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003311000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program ManagerLR]q
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003311000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $]q9<b>[ Program Manager]</b> (26/09/2024 17:46:33)<br>{Win}rTHbq@N7
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003389000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Time: 11/19/2024 17:45:25<br>User Name: user<br>Computer Name: 134349<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br><hr><b>[ Program Manager]</b> (26/09/2024 17:46:33)<br>{Win}r{Win}rTe]q
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003311000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $]q><b>[ Program Manager]</b> (26/09/2024 17:46:33)<br>{Win}r{Win}THbq@N7
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003311000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $]q3<b>[ Program Manager]</b> (26/09/2024 17:46:33)<br>
Source: Eschemyquote24573j33.exe, 00000004.00000002.4509927352.0000000003389000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: @\]qDTime: 11/19/2024 17:45:25<br>User Name: user<br>Computer Name: 134349<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br><hr><b>[ Program Manager]</b> (26/09/2024 17:46:33)<br>{Win}r{Win}r
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Users\user\Desktop\Eschemyquote24573j33.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Users\user\Desktop\Eschemyquote24573j33.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 8.2.ctsdvwT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.3f0d1a8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.4071760.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.4071760.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.39cb710.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.3990af0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.3f0d1a8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.39cb710.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2283120210.0000000004071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2255456964.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2283120210.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2069428436.0000000003909000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Eschemyquote24573j33.exe PID: 4332, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctsdvwT.exe PID: 320, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctsdvwT.exe PID: 2892, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\Eschemyquote24573j33.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Yara detected Credential Stealer
Source: Yara match File source: 8.2.ctsdvwT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.3f0d1a8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.4071760.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.4071760.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.39cb710.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.3990af0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.3f0d1a8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.39cb710.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2283120210.0000000004071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2255456964.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2283120210.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4509927352.0000000003311000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4509557072.000000000319B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2069428436.0000000003909000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2259031078.0000000003391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Eschemyquote24573j33.exe PID: 4332, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Eschemyquote24573j33.exe PID: 7140, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctsdvwT.exe PID: 320, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctsdvwT.exe PID: 2892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctsdvwT.exe PID: 7056, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 8.2.ctsdvwT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.3f0d1a8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.4071760.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.4071760.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.39cb710.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.3990af0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ctsdvwT.exe.3f0d1a8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.39cb710.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Eschemyquote24573j33.exe.3990af0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2283120210.0000000004071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2255456964.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2283120210.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2069428436.0000000003909000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Eschemyquote24573j33.exe PID: 4332, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctsdvwT.exe PID: 320, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctsdvwT.exe PID: 2892, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1519249 Sample: Eschemyquote24573j33.exe Startdate: 26/09/2024 Architecture: WINDOWS Score: 100 39 mail.musabody.com 2->39 51 Suricata IDS alerts for network traffic 2->51 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 8 other signatures 2->57 8 Eschemyquote24573j33.exe 4 2->8         started        12 ctsdvwT.exe 3 2->12         started        14 ctsdvwT.exe 2 2->14         started        signatures3 process4 file5 35 C:\Users\...schemyquote24573j33.exe.log, ASCII 8->35 dropped 59 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->59 61 Contains functionality to register a low level keyboard hook 8->61 63 Adds a directory exclusion to Windows Defender 8->63 16 Eschemyquote24573j33.exe 1 5 8->16         started        21 powershell.exe 23 8->21         started        65 Multi AV Scanner detection for dropped file 12->65 67 Machine Learning detection for dropped file 12->67 69 Injects a PE file into a foreign processes 12->69 23 ctsdvwT.exe 2 12->23         started        25 ctsdvwT.exe 14->25         started        signatures6 process7 dnsIp8 37 mail.musabody.com 108.167.140.123, 49716, 587 UNIFIEDLAYER-AS-1US United States 16->37 31 C:\Users\user\AppData\Roaming\...\ctsdvwT.exe, PE32 16->31 dropped 33 C:\Users\user\...\ctsdvwT.exe:Zone.Identifier, ASCII 16->33 dropped 41 Tries to steal Mail credentials (via file / registry access) 16->41 43 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->43 45 Installs a global keyboard hook 16->45 47 Loading BitLocker PowerShell Module 21->47 27 WmiPrvSE.exe 21->27         started        29 conhost.exe 21->29         started        49 Tries to harvest and steal browser information (history, passwords, etc) 25->49 file9 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
108.167.140.123
 mail.musabody.com United States
46606 UNIFIEDLAYER-AS-1US true

Contacted Domains

Name IP Active
mail.musabody.com 108.167.140.123 true