Windows Analysis Report
Quote List.scr.exe

Overview

General Information

Sample name: Quote List.scr.exe
Analysis ID: 1522468
MD5: dc2bce43a2b3398e375fdb600650a576
SHA1: a6c6ccf9affa2095eb481950f036c00cd3c4e437
SHA256: 509070cd30eb4cb05c29fe8cb222166c1c7db0f6084ea5b91e37bac79c14ac30
Tags: exeXenoRATuser-abuse_ch
Infos:

Detection

XenoRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected XenoRAT
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Script Execution From Temp Folder
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Costura Assembly Loader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Found malware configuration
Source: 0.2.Quote List.scr.exe.293d7e8.1.unpack Malware Configuration Extractor: XenoRAT {"C2 url": "66.63.168.142", "Mutex Name": "Microsoft_nd8912d", "Install Folder": "temp"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Virustotal: Detection: 26% Perma Link
Multi AV Scanner detection for submitted file
Source: Quote List.scr.exe ReversingLabs: Detection: 21%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.8% probability
Uses 32bit PE files
Source: Quote List.scr.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Quote List.scr.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: iepl.pdb source: Quote List.scr.exe, Quote List.scr.exe.4.dr
Source: Binary string: C:\Users\moom825\Desktop\xeno-rat\xeno-rat\Plugins\KeyLoggerOffline\obj\Release\KeyLoggerOffline.pdbYpsp ep_CorDllMainmscoree.dll source: Quote List.scr.exe, 00000008.00000002.4495765492.0000000005750000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: costura.costura.pdb.compressed source: Quote List.scr.exe, 00000008.00000002.4492030953.0000000002C9E000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: $jq&costura.xeno rat client.pdb.compressed4'jq source: Quote List.scr.exe, 00000008.00000002.4492030953.0000000002C9E000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: iepl.pdbSHA256 source: Quote List.scr.exe, Quote List.scr.exe.4.dr
Source: Binary string: C:\Users\moom825\Desktop\xeno-rat\xeno-rat\Plugins\KeyLoggerOffline\obj\Release\KeyLoggerOffline.pdb source: Quote List.scr.exe, 00000008.00000002.4495765492.0000000005750000.00000004.08000000.00040000.00000000.sdmp

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2050110 - Severity 1 - ET MALWARE [ANY.RUN] Xeno-RAT TCP Check-In : 66.63.168.142:4782 -> 192.168.2.5:49723
Source: Network traffic Suricata IDS: 2050111 - Severity 1 - ET MALWARE [ANY.RUN] Xeno-RAT TCP Keep-Alive : 192.168.2.5:49717 -> 66.63.168.142:4782
Source: Network traffic Suricata IDS: 2050111 - Severity 1 - ET MALWARE [ANY.RUN] Xeno-RAT TCP Keep-Alive : 192.168.2.5:49723 -> 66.63.168.142:4782
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 66.63.168.142
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 66.63.168.142:4782
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.168.142
Source: Quote List.scr.exe, Quote List.scr.exe.4.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Quote List.scr.exe, Quote List.scr.exe.4.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Quote List.scr.exe, Quote List.scr.exe.4.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: Quote List.scr.exe, 00000000.00000002.2060791178.00000000028EB000.00000004.00000800.00020000.00000000.sdmp, Quote List.scr.exe, 00000006.00000002.2084770494.000000000279B000.00000004.00000800.00020000.00000000.sdmp, Quote List.scr.exe, 00000008.00000002.4492030953.0000000002C61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: m3w51req.inw.8.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: m3w51req.inw.8.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: m3w51req.inw.8.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: m3w51req.inw.8.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: m3w51req.inw.8.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: m3w51req.inw.8.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: m3w51req.inw.8.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Quote List.scr.exe, Quote List.scr.exe.4.dr String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: m3w51req.inw.8.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: m3w51req.inw.8.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Installs a global keyboard hook
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8.2.Quote List.scr.exe.6870000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000008.00000002.4498347900.0000000006870000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_0785E0E0 0_2_0785E0E0
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07854D00 0_2_07854D00
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07854CF0 0_2_07854CF0
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_0785C468 0_2_0785C468
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_0785C478 0_2_0785C478
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_0785D0C9 0_2_0785D0C9
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_0785E0D0 0_2_0785E0D0
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_0785E838 0_2_0785E838
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B536D0 0_2_07B536D0
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B545F9 0_2_07B545F9
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B50040 0_2_07B50040
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B50F17 0_2_07B50F17
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B536C0 0_2_07B536C0
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B5C638 0_2_07B5C638
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B5C648 0_2_07B5C648
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B534B1 0_2_07B534B1
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B534C0 0_2_07B534C0
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B55331 0_2_07B55331
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B55378 0_2_07B55378
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B5C210 0_2_07B5C210
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B53260 0_2_07B53260
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B53250 0_2_07B53250
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B591B0 0_2_07B591B0
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B530B0 0_2_07B530B0
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B530C0 0_2_07B530C0
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B50006 0_2_07B50006
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B53EFB 0_2_07B53EFB
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B53E50 0_2_07B53E50
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B51E50 0_2_07B51E50
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B51E40 0_2_07B51E40
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B53E40 0_2_07B53E40
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B54E40 0_2_07B54E40
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B5BDC8 0_2_07B5BDC8
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B51C50 0_2_07B51C50
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B51C40 0_2_07B51C40
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B5CA80 0_2_07B5CA80
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B52A20 0_2_07B52A20
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B52A11 0_2_07B52A11
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B5EA00 0_2_07B5EA00
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07B53918 0_2_07B53918
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_0D8E2DF8 0_2_0D8E2DF8
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 4_2_01670B12 4_2_01670B12
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_0702E0E0 6_2_0702E0E0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_07024D00 6_2_07024D00
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_0702C468 6_2_0702C468
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_0702C478 6_2_0702C478
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_07024CF0 6_2_07024CF0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_0702E838 6_2_0702E838
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_0702D0C9 6_2_0702D0C9
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_0702E0D0 6_2_0702E0D0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E36D0 6_2_071E36D0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E45F9 6_2_071E45F9
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E0040 6_2_071E0040
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E0F17 6_2_071E0F17
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071EC638 6_2_071EC638
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071EC648 6_2_071EC648
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E36C0 6_2_071E36C0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E34B1 6_2_071E34B1
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E34C0 6_2_071E34C0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E5331 6_2_071E5331
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E5378 6_2_071E5378
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071EC210 6_2_071EC210
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E3250 6_2_071E3250
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E3260 6_2_071E3260
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E91B0 6_2_071E91B0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E0006 6_2_071E0006
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E30B0 6_2_071E30B0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E30C0 6_2_071E30C0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E3E50 6_2_071E3E50
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E1E50 6_2_071E1E50
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E1E40 6_2_071E1E40
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E3E40 6_2_071E3E40
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E4E40 6_2_071E4E40
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E3EFB 6_2_071E3EFB
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071EBDC8 6_2_071EBDC8
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E1C50 6_2_071E1C50
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E1C40 6_2_071E1C40
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E2A11 6_2_071E2A11
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071EEA00 6_2_071EEA00
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E2A20 6_2_071E2A20
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071ECA80 6_2_071ECA80
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_071E3918 6_2_071E3918
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_0D042DF8 6_2_0D042DF8
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_00E39048 8_2_00E39048
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_00E39918 8_2_00E39918
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_00E32321 8_2_00E32321
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_00E30B12 8_2_00E30B12
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_00E3DF52 8_2_00E3DF52
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_00E3EF30 8_2_00E3EF30
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_00E38D00 8_2_00E38D00
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_057665C8 8_2_057665C8
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_057665B8 8_2_057665B8
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_0576E8BC 8_2_0576E8BC
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_05C4A7D0 8_2_05C4A7D0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_05C40828 8_2_05C40828
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_05C4B518 8_2_05C4B518
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_05C491C8 8_2_05C491C8
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_05C47AF8 8_2_05C47AF8
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_05C46268 8_2_05C46268
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_069E87F0 8_2_069E87F0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_069E9BB8 8_2_069E9BB8
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_069E61D0 8_2_069E61D0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_069ED1D0 8_2_069ED1D0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_069E3F98 8_2_069E3F98
PE / OLE file has an invalid certificate
Source: Quote List.scr.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: Quote List.scr.exe, 00000000.00000002.2070835241.0000000007050000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000000.00000002.2060791178.000000000293C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepdf_manager.exe8 vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000000.00000002.2060008293.0000000000BEE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000000.00000000.2027008721.0000000000442000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameiepl.exe, vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000000.00000002.2062959144.0000000003F82000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000004.00000002.2052739105.000000000040E000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepdf_manager.exe8 vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000006.00000002.2083586338.000000000072E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000006.00000002.2085858304.000000000400F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000006.00000002.2085858304.0000000003FC2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000006.00000002.2084770494.00000000027EE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepdf_manager.exe8 vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000008.00000002.4497435157.0000000006439000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000008.00000002.4499560428.00000000074E0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameBouncyCastle.Crypto.dllP vs Quote List.scr.exe
Source: Quote List.scr.exe, 00000008.00000002.4495765492.0000000005750000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameKeyLoggerOffline.dllB vs Quote List.scr.exe
Source: Quote List.scr.exe Binary or memory string: OriginalFilenameiepl.exe, vs Quote List.scr.exe
Source: Quote List.scr.exe.4.dr Binary or memory string: OriginalFilenameiepl.exe, vs Quote List.scr.exe
Uses 32bit PE files
Source: Quote List.scr.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 8.2.Quote List.scr.exe.6870000.1.raw.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000008.00000002.4498347900.0000000006870000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Quote List.scr.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Quote List.scr.exe.4.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.Quote List.scr.exe.2948ec8.0.raw.unpack, Encryption.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Quote List.scr.exe.293d7e8.1.raw.unpack, Encryption.cs Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.Quote List.scr.exe.27fb098.1.raw.unpack, Encryption.cs Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.Quote List.scr.exe.27ef9b8.0.raw.unpack, Encryption.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, hC26RxYUjNAqPWbtXq.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, hC26RxYUjNAqPWbtXq.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 6.2.Quote List.scr.exe.27fb098.1.raw.unpack, Handler.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quote List.scr.exe.2948ec8.0.raw.unpack, Handler.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, hC26RxYUjNAqPWbtXq.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quote List.scr.exe.293d7e8.1.raw.unpack, Handler.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 6.2.Quote List.scr.exe.27ef9b8.0.raw.unpack, Handler.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, M44kKZXkZwVsM60at7.cs Security API names: _0020.SetAccessControl
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, M44kKZXkZwVsM60at7.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, M44kKZXkZwVsM60at7.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, M44kKZXkZwVsM60at7.cs Security API names: _0020.SetAccessControl
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, M44kKZXkZwVsM60at7.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, M44kKZXkZwVsM60at7.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, M44kKZXkZwVsM60at7.cs Security API names: _0020.SetAccessControl
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, M44kKZXkZwVsM60at7.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, M44kKZXkZwVsM60at7.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@13/22@0/1
Source: C:\Users\user\Desktop\Quote List.scr.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quote List.scr.exe.log Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1900:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Mutant created: \Sessions\1\BaseNamedObjects\Microsoft_nd8912d-admin
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Mutant created: \Sessions\1\BaseNamedObjects\aKYQDyHSi
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zw4qovnv.0io.ps1 Jump to behavior
Source: Quote List.scr.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Quote List.scr.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\Quote List.scr.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Quote List.scr.exe, 00000008.00000002.4492030953.00000000030D5000.00000004.00000800.00020000.00000000.sdmp, Quote List.scr.exe, 00000008.00000002.4492030953.00000000030C8000.00000004.00000800.00020000.00000000.sdmp, c0x15ytk.npd.8.dr, c5oaqdws.cs1.8.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Quote List.scr.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\Desktop\Quote List.scr.exe File read: C:\Users\user\Desktop\Quote List.scr.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Quote List.scr.exe "C:\Users\user\Desktop\Quote List.scr.exe"
Source: C:\Users\user\Desktop\Quote List.scr.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote List.scr.exe"
Source: C:\Users\user\Desktop\Quote List.scr.exe Process created: C:\Users\user\Desktop\Quote List.scr.exe "C:\Users\user\Desktop\Quote List.scr.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Quote List.scr.exe Process created: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe "C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe"
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe"
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process created: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe "C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Quote List.scr.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote List.scr.exe" Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process created: C:\Users\user\Desktop\Quote List.scr.exe "C:\Users\user\Desktop\Quote List.scr.exe" Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process created: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe "C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process created: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe "C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe" Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Quote List.scr.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Quote List.scr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Quote List.scr.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Quote List.scr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: iepl.pdb source: Quote List.scr.exe, Quote List.scr.exe.4.dr
Source: Binary string: C:\Users\moom825\Desktop\xeno-rat\xeno-rat\Plugins\KeyLoggerOffline\obj\Release\KeyLoggerOffline.pdbYpsp ep_CorDllMainmscoree.dll source: Quote List.scr.exe, 00000008.00000002.4495765492.0000000005750000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: costura.costura.pdb.compressed source: Quote List.scr.exe, 00000008.00000002.4492030953.0000000002C9E000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: $jq&costura.xeno rat client.pdb.compressed4'jq source: Quote List.scr.exe, 00000008.00000002.4492030953.0000000002C9E000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: iepl.pdbSHA256 source: Quote List.scr.exe, Quote List.scr.exe.4.dr
Source: Binary string: C:\Users\moom825\Desktop\xeno-rat\xeno-rat\Plugins\KeyLoggerOffline\obj\Release\KeyLoggerOffline.pdb source: Quote List.scr.exe, 00000008.00000002.4495765492.0000000005750000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, M44kKZXkZwVsM60at7.cs .Net Code: iXxP4Pucet System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quote List.scr.exe.7b10000.6.raw.unpack, MainForm.cs .Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quote List.scr.exe.3751c20.2.raw.unpack, MainForm.cs .Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quote List.scr.exe.2948ec8.0.raw.unpack, DllHandler.cs .Net Code: DllNodeHandler System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quote List.scr.exe.2948ec8.0.raw.unpack, DllHandler.cs .Net Code: DllNodeHandler
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, M44kKZXkZwVsM60at7.cs .Net Code: iXxP4Pucet System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, M44kKZXkZwVsM60at7.cs .Net Code: iXxP4Pucet System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quote List.scr.exe.293d7e8.1.raw.unpack, DllHandler.cs .Net Code: DllNodeHandler System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quote List.scr.exe.293d7e8.1.raw.unpack, DllHandler.cs .Net Code: DllNodeHandler
Source: 6.2.Quote List.scr.exe.27fb098.1.raw.unpack, DllHandler.cs .Net Code: DllNodeHandler System.Reflection.Assembly.Load(byte[])
Source: 6.2.Quote List.scr.exe.27fb098.1.raw.unpack, DllHandler.cs .Net Code: DllNodeHandler
Source: 6.2.Quote List.scr.exe.27ef9b8.0.raw.unpack, DllHandler.cs .Net Code: DllNodeHandler System.Reflection.Assembly.Load(byte[])
Source: 6.2.Quote List.scr.exe.27ef9b8.0.raw.unpack, DllHandler.cs .Net Code: DllNodeHandler
Source: 8.2.Quote List.scr.exe.6870000.1.raw.unpack, AssemblyLoader.cs .Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
Yara detected Costura Assembly Loader
Source: Yara match File source: 8.2.Quote List.scr.exe.6870000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.Quote List.scr.exe.6870000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.4498347900.0000000006870000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4492030953.0000000002C9E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Quote List.scr.exe PID: 7304, type: MEMORYSTR
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_00F70DFA pushfd ; iretd 0_2_00F70DF9
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_00F70DAF pushfd ; iretd 0_2_00F70DF9
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_00F70D62 pushfd ; iretd 0_2_00F70DF9
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07853E78 push eax; mov dword ptr [esp], ecx 0_2_07853E7C
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07857080 pushad ; ret 0_2_07857081
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_07857082 push esp; ret 0_2_07857089
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_0D8E05C8 push E8FFFFFEh; iretd 0_2_0D8E05CD
Source: C:\Users\user\Desktop\Quote List.scr.exe Code function: 0_2_0D8E1312 push 84070BCBh; retf 0_2_0D8E1319
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_07023E78 push eax; mov dword ptr [esp], ecx 6_2_07023E7C
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_07027080 pushad ; ret 6_2_07027081
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_0D0405C8 push E8FFFFFEh; iretd 6_2_0D0405CD
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 6_2_0D041312 push 8406D5CBh; retf 6_2_0D041319
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_05C40FB3 pushfd ; ret 8_2_05C40FB9
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_05C40EE3 push eax; ret 8_2_05C40EE9
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_05C475B0 push es; ret 8_2_05C475C0
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_069E0705 pushad ; retf 8_2_069E0729
Source: Quote List.scr.exe Static PE information: section name: .text entropy: 7.611324168922041
Source: Quote List.scr.exe.4.dr Static PE information: section name: .text entropy: 7.611324168922041
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, BCfW00hquI4drcPhUw.cs High entropy of concatenated method names: 'ryCq09npic', 'kiFqm1JiUP', 'zMfqvv1XA1', 'FlFqKmxiZB', 'BiRqX89ena', 'Cp8vQGBZyr', 'gkyvwI1dhF', 'IZhvZQM6oK', 'mEvvxRlUy9', 'TxkvJQ9opV'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, MmvHbmzYjio9BAe4A1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mxMF28d1o5', 'IaJFAAsnWU', 'C4SFCZpesf', 'vaVFR8X8Qx', 'T4xFSivsSy', 'i55FFGUgJG', 'dHmFysQVjA'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, hC26RxYUjNAqPWbtXq.cs High entropy of concatenated method names: 'm8KmB0lYxH', 'QgQmWZyoEc', 'mIymalgo25', 'YDBmdBL5Cb', 'oNwmQH1HlP', 'LlnmwfE14K', 'ojymZ5e74t', 'yy1mxcH7uP', 'u8vmJCSwG0', 'YkrmtRRcKU'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, BEwP9Y5uDtCy7Risup.cs High entropy of concatenated method names: 'MnR4xwW3I', 'f7DHvtYlE', 'sw4MNRtXQ', 'XQu6gfERh', 'JBqbk8obC', 'i5dGxeWwy', 'nZiQj1nR26d72e7t4h', 'p8YrfLEqGPDlXUBqrs', 'CLVSJeGJ6', 'j3Ky98ECp'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, uGnN0BxZ2Ki4RZ1mgk.cs High entropy of concatenated method names: 'o3nSn5erSS', 'QCgSmnGhkK', 'UiRS93QUB2', 'bmhSvwyshv', 'XVHSq6LN8i', 'gbFSKEQxr0', 'CCySXTopdO', 'k2KSN0WCLp', 'vHMSe93ZZ4', 'PDiSOWi4IX'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, uxWvjLaB5S5L5U11SW.cs High entropy of concatenated method names: 'ToString', 'slSCVEhZ6b', 'dWMCfuCerf', 'MOQCEv4V0g', 'vIJCL3sLOT', 'UV8CpJVv9P', 'a2fC1cgV6x', 'cJ2CktnRxc', 'ouqCrmhc0i', 'ktZCsUNDLw'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, GaraT7GVp4B2XVGHtC.cs High entropy of concatenated method names: 'iOHvgKqkfv', 'URLv6qhkl3', 'VMJ9EmiRQ6', 'kmG9LOO0d2', 'Lgq9psyFae', 'wiU91uv4ab', 'CD29kP326a', 'CMF9r08Fa9', 'EnI9s6gBys', 'XhX9jFnT8f'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, DX4cEsolyRsUMUGDirV.cs High entropy of concatenated method names: 'wiBF3Vb3YP', 'oToFTgR0Rf', 'rKcF4WNZL8', 'hZQFHjyKcS', 'LpwFgZDas2', 'bg6FMtOtBy', 'BUiF6MUesN', 'aPDFYmdf8s', 'IaDFbJUv4d', 'H18FGjSRnj'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, aauewlkV5410Xauive.cs High entropy of concatenated method names: 'pDhKnpU9ud', 'smhK9rsc1u', 'NTUKqrFi9f', 'BAPqteWqP0', 'c6AqzDO11G', 'OogKlmKldA', 'HYuKooO46A', 'VjXK5ZL66s', 'yneKDx5wxL', 'eu9KPdSv4W'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, rd84D8wujLteeJJVrA.cs High entropy of concatenated method names: 'aelRxmNAaK', 'kZ5Rt0I3Rr', 'xCfSl9VVMw', 'FQeSo8gcZY', 'xwaRVuiUtG', 'AgBRiNgO3c', 'WbURUmUNhJ', 'udYRBpsYYu', 'OpmRWXhHv2', 'VYZRaiddou'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, sWhAK5oDjLw31NyCTdc.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RORyBtb5y1', 'RbMyWdnqQS', 'CmkyaDgiwg', 'cj8ydssJg0', 'zQcyQ3JX21', 'FJDywWHDoD', 'nxIyZ4wQIm'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, YgNn5yPColpDsSyee1.cs High entropy of concatenated method names: 'yrvoKC26Rx', 'QjNoXAqPWb', 'kseoeYdXn1', 'ImpoOohara', 'OGHoAtCMCf', 'R00oCquI4d', 'o9UYjNeDqEbjV5dt6o', 'X7Lylhd4QnN7QPBXpD', 'vEkooZXeVA', 'mYOoDKgSMw'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, qeRjJusKlXiMDxqAIL.cs High entropy of concatenated method names: 'AfMK3keBN2', 'JSOKT38Va3', 'RBcK4eIVDh', 'VooKH1085D', 'xOYKgkYjJK', 'tAtKMOCkJC', 'RtRK6eX5DT', 'bb7KY23w6W', 'VDQKbgfaEd', 'Gb9KGMG4Yk'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, m8Df1XbseYdXn1Lmpo.cs High entropy of concatenated method names: 'hr59HPiBsm', 'eN89MApKWl', 'EMI9YtNyff', 'Yc29bYyRXN', 'm4p9AGwBFY', 'DlL9Cbx6EW', 'AHe9RxeOI4', 'aqc9SpEGqs', 'pRe9FbxeHV', 'YBd9yhMaEB'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, sSPf2XtCj1ADgrgOa2.cs High entropy of concatenated method names: 'omYFoyCLQp', 'lpDFDdYorL', 'MCAFPssy8e', 'SW9Fn8FHu2', 'hSbFmAIgWu', 'OC0FvJ7ApD', 'CUmFq3ri4U', 'N5QSZ2M1xJ', 'XGNSxbTTgD', 'SrFSJlNWd1'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, M44kKZXkZwVsM60at7.cs High entropy of concatenated method names: 'F7eD0a58py', 'OOwDnqQBfL', 'Vx7DmSJaxo', 'sGBD9ri4eF', 'GXgDvMOu0V', 'oUKDqSf2FW', 'XwrDKX4RLB', 'MC6DXPqFZn', 'w5BDNApy1h', 'JTCDeDMeQ8'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, aGLNUNJQSQFJGTs0OW.cs High entropy of concatenated method names: 'CjuShiFCN9', 'rmKSfMfgMh', 'PqxSEJ7EE6', 'wg4SLpwxPr', 'j3fSB4oxtb', 'sbBSp9TGbv', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, CJb8SAmHKUInw3xxbP.cs High entropy of concatenated method names: 'Dispose', 'u6MoJwbj8L', 'sY25fckibC', 'wrbiirTZwg', 'ycGotnN0BZ', 'oKioz4RZ1m', 'ProcessDialogKey', 'Bkl5lGLNUN', 'USQ5oFJGTs', 'eOW55FSPf2'
Source: 0.2.Quote List.scr.exe.7050000.5.raw.unpack, pdRpjyU5XUnOYfgY7d.cs High entropy of concatenated method names: 'MbS2YC6FJt', 'KVG2bHAHcr', 'Icj2h9Anyw', 'OrZ2fscNh1', 'AkO2LKijUJ', 'MXr2p6uEdg', 'xww2kbdbIH', 'rWt2rQb4OG', 'cRd2j6X5Sk', 'VHa2VUlTk5'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, BCfW00hquI4drcPhUw.cs High entropy of concatenated method names: 'ryCq09npic', 'kiFqm1JiUP', 'zMfqvv1XA1', 'FlFqKmxiZB', 'BiRqX89ena', 'Cp8vQGBZyr', 'gkyvwI1dhF', 'IZhvZQM6oK', 'mEvvxRlUy9', 'TxkvJQ9opV'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, MmvHbmzYjio9BAe4A1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mxMF28d1o5', 'IaJFAAsnWU', 'C4SFCZpesf', 'vaVFR8X8Qx', 'T4xFSivsSy', 'i55FFGUgJG', 'dHmFysQVjA'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, hC26RxYUjNAqPWbtXq.cs High entropy of concatenated method names: 'm8KmB0lYxH', 'QgQmWZyoEc', 'mIymalgo25', 'YDBmdBL5Cb', 'oNwmQH1HlP', 'LlnmwfE14K', 'ojymZ5e74t', 'yy1mxcH7uP', 'u8vmJCSwG0', 'YkrmtRRcKU'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, BEwP9Y5uDtCy7Risup.cs High entropy of concatenated method names: 'MnR4xwW3I', 'f7DHvtYlE', 'sw4MNRtXQ', 'XQu6gfERh', 'JBqbk8obC', 'i5dGxeWwy', 'nZiQj1nR26d72e7t4h', 'p8YrfLEqGPDlXUBqrs', 'CLVSJeGJ6', 'j3Ky98ECp'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, uGnN0BxZ2Ki4RZ1mgk.cs High entropy of concatenated method names: 'o3nSn5erSS', 'QCgSmnGhkK', 'UiRS93QUB2', 'bmhSvwyshv', 'XVHSq6LN8i', 'gbFSKEQxr0', 'CCySXTopdO', 'k2KSN0WCLp', 'vHMSe93ZZ4', 'PDiSOWi4IX'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, uxWvjLaB5S5L5U11SW.cs High entropy of concatenated method names: 'ToString', 'slSCVEhZ6b', 'dWMCfuCerf', 'MOQCEv4V0g', 'vIJCL3sLOT', 'UV8CpJVv9P', 'a2fC1cgV6x', 'cJ2CktnRxc', 'ouqCrmhc0i', 'ktZCsUNDLw'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, GaraT7GVp4B2XVGHtC.cs High entropy of concatenated method names: 'iOHvgKqkfv', 'URLv6qhkl3', 'VMJ9EmiRQ6', 'kmG9LOO0d2', 'Lgq9psyFae', 'wiU91uv4ab', 'CD29kP326a', 'CMF9r08Fa9', 'EnI9s6gBys', 'XhX9jFnT8f'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, DX4cEsolyRsUMUGDirV.cs High entropy of concatenated method names: 'wiBF3Vb3YP', 'oToFTgR0Rf', 'rKcF4WNZL8', 'hZQFHjyKcS', 'LpwFgZDas2', 'bg6FMtOtBy', 'BUiF6MUesN', 'aPDFYmdf8s', 'IaDFbJUv4d', 'H18FGjSRnj'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, aauewlkV5410Xauive.cs High entropy of concatenated method names: 'pDhKnpU9ud', 'smhK9rsc1u', 'NTUKqrFi9f', 'BAPqteWqP0', 'c6AqzDO11G', 'OogKlmKldA', 'HYuKooO46A', 'VjXK5ZL66s', 'yneKDx5wxL', 'eu9KPdSv4W'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, rd84D8wujLteeJJVrA.cs High entropy of concatenated method names: 'aelRxmNAaK', 'kZ5Rt0I3Rr', 'xCfSl9VVMw', 'FQeSo8gcZY', 'xwaRVuiUtG', 'AgBRiNgO3c', 'WbURUmUNhJ', 'udYRBpsYYu', 'OpmRWXhHv2', 'VYZRaiddou'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, sWhAK5oDjLw31NyCTdc.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RORyBtb5y1', 'RbMyWdnqQS', 'CmkyaDgiwg', 'cj8ydssJg0', 'zQcyQ3JX21', 'FJDywWHDoD', 'nxIyZ4wQIm'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, YgNn5yPColpDsSyee1.cs High entropy of concatenated method names: 'yrvoKC26Rx', 'QjNoXAqPWb', 'kseoeYdXn1', 'ImpoOohara', 'OGHoAtCMCf', 'R00oCquI4d', 'o9UYjNeDqEbjV5dt6o', 'X7Lylhd4QnN7QPBXpD', 'vEkooZXeVA', 'mYOoDKgSMw'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, qeRjJusKlXiMDxqAIL.cs High entropy of concatenated method names: 'AfMK3keBN2', 'JSOKT38Va3', 'RBcK4eIVDh', 'VooKH1085D', 'xOYKgkYjJK', 'tAtKMOCkJC', 'RtRK6eX5DT', 'bb7KY23w6W', 'VDQKbgfaEd', 'Gb9KGMG4Yk'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, m8Df1XbseYdXn1Lmpo.cs High entropy of concatenated method names: 'hr59HPiBsm', 'eN89MApKWl', 'EMI9YtNyff', 'Yc29bYyRXN', 'm4p9AGwBFY', 'DlL9Cbx6EW', 'AHe9RxeOI4', 'aqc9SpEGqs', 'pRe9FbxeHV', 'YBd9yhMaEB'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, sSPf2XtCj1ADgrgOa2.cs High entropy of concatenated method names: 'omYFoyCLQp', 'lpDFDdYorL', 'MCAFPssy8e', 'SW9Fn8FHu2', 'hSbFmAIgWu', 'OC0FvJ7ApD', 'CUmFq3ri4U', 'N5QSZ2M1xJ', 'XGNSxbTTgD', 'SrFSJlNWd1'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, M44kKZXkZwVsM60at7.cs High entropy of concatenated method names: 'F7eD0a58py', 'OOwDnqQBfL', 'Vx7DmSJaxo', 'sGBD9ri4eF', 'GXgDvMOu0V', 'oUKDqSf2FW', 'XwrDKX4RLB', 'MC6DXPqFZn', 'w5BDNApy1h', 'JTCDeDMeQ8'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, aGLNUNJQSQFJGTs0OW.cs High entropy of concatenated method names: 'CjuShiFCN9', 'rmKSfMfgMh', 'PqxSEJ7EE6', 'wg4SLpwxPr', 'j3fSB4oxtb', 'sbBSp9TGbv', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, CJb8SAmHKUInw3xxbP.cs High entropy of concatenated method names: 'Dispose', 'u6MoJwbj8L', 'sY25fckibC', 'wrbiirTZwg', 'ycGotnN0BZ', 'oKioz4RZ1m', 'ProcessDialogKey', 'Bkl5lGLNUN', 'USQ5oFJGTs', 'eOW55FSPf2'
Source: 0.2.Quote List.scr.exe.41126e0.3.raw.unpack, pdRpjyU5XUnOYfgY7d.cs High entropy of concatenated method names: 'MbS2YC6FJt', 'KVG2bHAHcr', 'Icj2h9Anyw', 'OrZ2fscNh1', 'AkO2LKijUJ', 'MXr2p6uEdg', 'xww2kbdbIH', 'rWt2rQb4OG', 'cRd2j6X5Sk', 'VHa2VUlTk5'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, BCfW00hquI4drcPhUw.cs High entropy of concatenated method names: 'ryCq09npic', 'kiFqm1JiUP', 'zMfqvv1XA1', 'FlFqKmxiZB', 'BiRqX89ena', 'Cp8vQGBZyr', 'gkyvwI1dhF', 'IZhvZQM6oK', 'mEvvxRlUy9', 'TxkvJQ9opV'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, MmvHbmzYjio9BAe4A1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mxMF28d1o5', 'IaJFAAsnWU', 'C4SFCZpesf', 'vaVFR8X8Qx', 'T4xFSivsSy', 'i55FFGUgJG', 'dHmFysQVjA'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, hC26RxYUjNAqPWbtXq.cs High entropy of concatenated method names: 'm8KmB0lYxH', 'QgQmWZyoEc', 'mIymalgo25', 'YDBmdBL5Cb', 'oNwmQH1HlP', 'LlnmwfE14K', 'ojymZ5e74t', 'yy1mxcH7uP', 'u8vmJCSwG0', 'YkrmtRRcKU'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, BEwP9Y5uDtCy7Risup.cs High entropy of concatenated method names: 'MnR4xwW3I', 'f7DHvtYlE', 'sw4MNRtXQ', 'XQu6gfERh', 'JBqbk8obC', 'i5dGxeWwy', 'nZiQj1nR26d72e7t4h', 'p8YrfLEqGPDlXUBqrs', 'CLVSJeGJ6', 'j3Ky98ECp'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, uGnN0BxZ2Ki4RZ1mgk.cs High entropy of concatenated method names: 'o3nSn5erSS', 'QCgSmnGhkK', 'UiRS93QUB2', 'bmhSvwyshv', 'XVHSq6LN8i', 'gbFSKEQxr0', 'CCySXTopdO', 'k2KSN0WCLp', 'vHMSe93ZZ4', 'PDiSOWi4IX'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, uxWvjLaB5S5L5U11SW.cs High entropy of concatenated method names: 'ToString', 'slSCVEhZ6b', 'dWMCfuCerf', 'MOQCEv4V0g', 'vIJCL3sLOT', 'UV8CpJVv9P', 'a2fC1cgV6x', 'cJ2CktnRxc', 'ouqCrmhc0i', 'ktZCsUNDLw'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, GaraT7GVp4B2XVGHtC.cs High entropy of concatenated method names: 'iOHvgKqkfv', 'URLv6qhkl3', 'VMJ9EmiRQ6', 'kmG9LOO0d2', 'Lgq9psyFae', 'wiU91uv4ab', 'CD29kP326a', 'CMF9r08Fa9', 'EnI9s6gBys', 'XhX9jFnT8f'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, DX4cEsolyRsUMUGDirV.cs High entropy of concatenated method names: 'wiBF3Vb3YP', 'oToFTgR0Rf', 'rKcF4WNZL8', 'hZQFHjyKcS', 'LpwFgZDas2', 'bg6FMtOtBy', 'BUiF6MUesN', 'aPDFYmdf8s', 'IaDFbJUv4d', 'H18FGjSRnj'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, aauewlkV5410Xauive.cs High entropy of concatenated method names: 'pDhKnpU9ud', 'smhK9rsc1u', 'NTUKqrFi9f', 'BAPqteWqP0', 'c6AqzDO11G', 'OogKlmKldA', 'HYuKooO46A', 'VjXK5ZL66s', 'yneKDx5wxL', 'eu9KPdSv4W'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, rd84D8wujLteeJJVrA.cs High entropy of concatenated method names: 'aelRxmNAaK', 'kZ5Rt0I3Rr', 'xCfSl9VVMw', 'FQeSo8gcZY', 'xwaRVuiUtG', 'AgBRiNgO3c', 'WbURUmUNhJ', 'udYRBpsYYu', 'OpmRWXhHv2', 'VYZRaiddou'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, sWhAK5oDjLw31NyCTdc.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RORyBtb5y1', 'RbMyWdnqQS', 'CmkyaDgiwg', 'cj8ydssJg0', 'zQcyQ3JX21', 'FJDywWHDoD', 'nxIyZ4wQIm'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, YgNn5yPColpDsSyee1.cs High entropy of concatenated method names: 'yrvoKC26Rx', 'QjNoXAqPWb', 'kseoeYdXn1', 'ImpoOohara', 'OGHoAtCMCf', 'R00oCquI4d', 'o9UYjNeDqEbjV5dt6o', 'X7Lylhd4QnN7QPBXpD', 'vEkooZXeVA', 'mYOoDKgSMw'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, qeRjJusKlXiMDxqAIL.cs High entropy of concatenated method names: 'AfMK3keBN2', 'JSOKT38Va3', 'RBcK4eIVDh', 'VooKH1085D', 'xOYKgkYjJK', 'tAtKMOCkJC', 'RtRK6eX5DT', 'bb7KY23w6W', 'VDQKbgfaEd', 'Gb9KGMG4Yk'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, m8Df1XbseYdXn1Lmpo.cs High entropy of concatenated method names: 'hr59HPiBsm', 'eN89MApKWl', 'EMI9YtNyff', 'Yc29bYyRXN', 'm4p9AGwBFY', 'DlL9Cbx6EW', 'AHe9RxeOI4', 'aqc9SpEGqs', 'pRe9FbxeHV', 'YBd9yhMaEB'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, sSPf2XtCj1ADgrgOa2.cs High entropy of concatenated method names: 'omYFoyCLQp', 'lpDFDdYorL', 'MCAFPssy8e', 'SW9Fn8FHu2', 'hSbFmAIgWu', 'OC0FvJ7ApD', 'CUmFq3ri4U', 'N5QSZ2M1xJ', 'XGNSxbTTgD', 'SrFSJlNWd1'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, M44kKZXkZwVsM60at7.cs High entropy of concatenated method names: 'F7eD0a58py', 'OOwDnqQBfL', 'Vx7DmSJaxo', 'sGBD9ri4eF', 'GXgDvMOu0V', 'oUKDqSf2FW', 'XwrDKX4RLB', 'MC6DXPqFZn', 'w5BDNApy1h', 'JTCDeDMeQ8'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, aGLNUNJQSQFJGTs0OW.cs High entropy of concatenated method names: 'CjuShiFCN9', 'rmKSfMfgMh', 'PqxSEJ7EE6', 'wg4SLpwxPr', 'j3fSB4oxtb', 'sbBSp9TGbv', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, CJb8SAmHKUInw3xxbP.cs High entropy of concatenated method names: 'Dispose', 'u6MoJwbj8L', 'sY25fckibC', 'wrbiirTZwg', 'ycGotnN0BZ', 'oKioz4RZ1m', 'ProcessDialogKey', 'Bkl5lGLNUN', 'USQ5oFJGTs', 'eOW55FSPf2'
Source: 0.2.Quote List.scr.exe.40c56c0.4.raw.unpack, pdRpjyU5XUnOYfgY7d.cs High entropy of concatenated method names: 'MbS2YC6FJt', 'KVG2bHAHcr', 'Icj2h9Anyw', 'OrZ2fscNh1', 'AkO2LKijUJ', 'MXr2p6uEdg', 'xww2kbdbIH', 'rWt2rQb4OG', 'cRd2j6X5Sk', 'VHa2VUlTk5'
Drops PE files
Source: C:\Users\user\Desktop\Quote List.scr.exe File created: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Quote List.scr.exe PID: 5372, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Quote List.scr.exe PID: 7200, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: F70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: 2720000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: 4720000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: 7CA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: 8CA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: 8E70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: 9E70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: A210000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: B210000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: C210000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: 1630000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: 3060000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: 2E60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: 23A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: 25D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: 2420000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: 7520000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: 8520000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: 86D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: 96D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: 9A30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: AA30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: BA30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: E30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: 2C60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory allocated: 4C60000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Quote List.scr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5907 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2219 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6034 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 799 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Window / User API: threadDelayed 4106 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Window / User API: threadDelayed 5734 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Quote List.scr.exe TID: 2672 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7256 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7216 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe TID: 6128 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe TID: 7232 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440 Thread sleep count: 6034 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7424 Thread sleep count: 799 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7476 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7460 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe TID: 7380 Thread sleep time: -8301034833169293s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe TID: 7392 Thread sleep count: 4106 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe TID: 7416 Thread sleep count: 5734 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: szy1nek2.2qr.8.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: szy1nek2.2qr.8.dr Binary or memory string: discord.comVMware20,11696428655f
Source: szy1nek2.2qr.8.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: szy1nek2.2qr.8.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: szy1nek2.2qr.8.dr Binary or memory string: global block list test formVMware20,11696428655
Source: szy1nek2.2qr.8.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Quote List.scr.exe, 00000000.00000002.2060080059.0000000000C21000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: szy1nek2.2qr.8.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: szy1nek2.2qr.8.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: szy1nek2.2qr.8.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: szy1nek2.2qr.8.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: Quote List.scr.exe, 00000004.00000002.2053003357.0000000001316000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y\
Source: szy1nek2.2qr.8.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Quote List.scr.exe, 00000008.00000002.4491025861.0000000000E75000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla
Source: szy1nek2.2qr.8.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: szy1nek2.2qr.8.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: szy1nek2.2qr.8.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: szy1nek2.2qr.8.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: szy1nek2.2qr.8.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: szy1nek2.2qr.8.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: szy1nek2.2qr.8.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: szy1nek2.2qr.8.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: szy1nek2.2qr.8.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: szy1nek2.2qr.8.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Quote List.scr.exe, 00000004.00000002.2053003357.000000000134D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^^1
Source: szy1nek2.2qr.8.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: szy1nek2.2qr.8.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: szy1nek2.2qr.8.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: szy1nek2.2qr.8.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: szy1nek2.2qr.8.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: szy1nek2.2qr.8.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: szy1nek2.2qr.8.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: szy1nek2.2qr.8.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: szy1nek2.2qr.8.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: szy1nek2.2qr.8.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Users\user\Desktop\Quote List.scr.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Code function: 8_2_00E3EF30 LdrInitializeThunk, 8_2_00E3EF30
Enables debug privileges
Source: C:\Users\user\Desktop\Quote List.scr.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Quote List.scr.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote List.scr.exe"
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe"
Source: C:\Users\user\Desktop\Quote List.scr.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote List.scr.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Quote List.scr.exe Memory written: C:\Users\user\Desktop\Quote List.scr.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Memory written: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Quote List.scr.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote List.scr.exe" Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process created: C:\Users\user\Desktop\Quote List.scr.exe "C:\Users\user\Desktop\Quote List.scr.exe" Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Process created: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe "C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Process created: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe "C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe" Jump to behavior
Source: Quote List.scr.exe, 00000008.00000002.4492030953.0000000002EBB000.00000004.00000800.00020000.00000000.sdmp, Quote List.scr.exe, 00000008.00000002.4492030953.0000000002D5D000.00000004.00000800.00020000.00000000.sdmp, Quote List.scr.exe, 00000008.00000002.4492030953.0000000002C9E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: Quote List.scr.exe, 00000008.00000002.4492030953.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, Quote List.scr.exe, 00000008.00000002.4492030953.0000000002EBB000.00000004.00000800.00020000.00000000.sdmp, Quote List.scr.exe, 00000008.00000002.4492030953.0000000002F19000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: explorer - Prog@\jq explorer - Program Manager
Source: Quote List.scr.exe, 00000008.00000002.4492030953.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, Quote List.scr.exe, 00000008.00000002.4492030953.0000000002EBB000.00000004.00000800.00020000.00000000.sdmp, Quote List.scr.exe, 00000008.00000002.4492030953.0000000002F19000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: explorer - Program Manager
Source: Quote List.scr.exe, 00000008.00000002.4492030953.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: explorer - Program ManagerP
Source: Quote List.scr.exe, 00000008.00000002.4492030953.0000000002EBB000.00000004.00000800.00020000.00000000.sdmp, Quote List.scr.exe, 00000008.00000002.4492030953.0000000002D5D000.00000004.00000800.00020000.00000000.sdmp, Quote List.scr.exe, 00000008.00000002.4492030953.0000000002C9E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program ManagerlBjq
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Quote List.scr.exe Queries volume information: C:\Users\user\Desktop\Quote List.scr.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Queries volume information: C:\Users\user\Desktop\Quote List.scr.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote List.scr.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected XenoRAT
Source: Yara match File source: 6.2.Quote List.scr.exe.27ef9b8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Quote List.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Quote List.scr.exe.293d7e8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Quote List.scr.exe.293d7e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Quote List.scr.exe.2948ec8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Quote List.scr.exe.27fb098.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Quote List.scr.exe.2948ec8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Quote List.scr.exe.27ef9b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Quote List.scr.exe.27fb098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2060791178.000000000293C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2084770494.00000000027EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2052739105.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Quote List.scr.exe PID: 5372, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Quote List.scr.exe PID: 6548, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Quote List.scr.exe PID: 7200, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XenoManager\Quote List.scr.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior

Remote Access Functionality
barindex
Yara detected XenoRAT
Source: Yara match File source: 6.2.Quote List.scr.exe.27ef9b8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Quote List.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Quote List.scr.exe.293d7e8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Quote List.scr.exe.293d7e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Quote List.scr.exe.2948ec8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Quote List.scr.exe.27fb098.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Quote List.scr.exe.2948ec8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Quote List.scr.exe.27ef9b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Quote List.scr.exe.27fb098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2060791178.000000000293C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2084770494.00000000027EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2052739105.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Quote List.scr.exe PID: 5372, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Quote List.scr.exe PID: 6548, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Quote List.scr.exe PID: 7200, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1522468 Sample: Quote List.scr.exe Startdate: 30/09/2024 Architecture: WINDOWS Score: 100 42 Suricata IDS alerts for network traffic 2->42 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 11 other signatures 2->48 9 Quote List.scr.exe 4 2->9         started        process3 file4 32 C:\Users\user\...\Quote List.scr.exe.log, CSV 9->32 dropped 60 Adds a directory exclusion to Windows Defender 9->60 62 Injects a PE file into a foreign processes 9->62 13 Quote List.scr.exe 4 9->13         started        16 powershell.exe 23 9->16         started        signatures5 process6 file7 34 C:\Users\user\AppData\...\Quote List.scr.exe, PE32 13->34 dropped 36 C:\...\Quote List.scr.exe:Zone.Identifier, ASCII 13->36 dropped 19 Quote List.scr.exe 3 13->19         started        40 Loading BitLocker PowerShell Module 16->40 22 conhost.exe 16->22         started        signatures8 process9 signatures10 50 Adds a directory exclusion to Windows Defender 19->50 52 Injects a PE file into a foreign processes 19->52 24 Quote List.scr.exe 14 19->24         started        28 powershell.exe 23 19->28         started        process11 dnsIp12 38 66.63.168.142, 4782, 49709, 49717 ASN-QUADRANET-GLOBALUS United States 24->38 54 Tries to harvest and steal browser information (history, passwords, etc) 24->54 56 Installs a global keyboard hook 24->56 58 Loading BitLocker PowerShell Module 28->58 30 conhost.exe 28->30         started        signatures13 process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
66.63.168.142
 unknown United States
8100 ASN-QUADRANET-GLOBALUS true

Contacted URLs

Name Malicious Antivirus Detection Reputation
66.63.168.142 true unknown