Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Quote GVSE24-00815.exe

Overview

General Information

Sample name:Quote GVSE24-00815.exe
Analysis ID:1561754
MD5:d04fe8d654f371aba620596e67963714
SHA1:7e1ff1be9962bc31859cfc22757aad3df52ea193
SHA256:9c9405332a044a5f3222dfc59bc8b36a4cd6fc4542c8651667aaf2101bb54ea8
Tags:exeuser-abuse_ch
Infos:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE / OLE file has an invalid certificate
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Outbound SMTP Connections
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Quote GVSE24-00815.exe (PID: 6260 cmdline: "C:\Users\user\Desktop\Quote GVSE24-00815.exe" MD5: D04FE8D654F371ABA620596E67963714)
    • powershell.exe (PID: 5304 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 5016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • Quote GVSE24-00815.exe (PID: 3732 cmdline: "C:\Users\user\Desktop\Quote GVSE24-00815.exe" MD5: D04FE8D654F371ABA620596E67963714)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Agent Tesla, AgentTeslaA .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.zqamcx.com", "Username": "servertwo@zqamcx.com", "Password": "Anambraeast@"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.4139084542.0000000002EE5000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000004.00000002.4139084542.0000000002EC2000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000004.00000002.4139084542.0000000002E95000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            Click to see the 8 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            4.2.Quote GVSE24-00815.exe.400000.0.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
              4.2.Quote GVSE24-00815.exe.400000.0.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
                4.2.Quote GVSE24-00815.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  4.2.Quote GVSE24-00815.exe.400000.0.unpackINDICATOR_SUSPICIOUS_EXE_VaultSchemaGUIDDetects executables referencing Windows vault credential objects. Observed in infostealersditekSHen
                  • 0x34847:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5
                  • 0x348b9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55
                  • 0x34943:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F
                  • 0x349d5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28
                  • 0x34a3f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29
                  • 0x34ab1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
                  • 0x34b47:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
                  • 0x34bd7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
                  0.2.Quote GVSE24-00815.exe.395e2c0.2.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                    Click to see the 13 entries

                    Sigma Signatures

                    System Summary

                    barindex
                    Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Quote GVSE24-00815.exe", ParentImage: C:\Users\user\Desktop\Quote GVSE24-00815.exe, ParentProcessId: 6260, ParentProcessName: Quote GVSE24-00815.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe", ProcessId: 5304, ProcessName: powershell.exe
                    Sigma detected: Powershell Defender Exclusion
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Quote GVSE24-00815.exe", ParentImage: C:\Users\user\Desktop\Quote GVSE24-00815.exe, ParentProcessId: 6260, ParentProcessName: Quote GVSE24-00815.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe", ProcessId: 5304, ProcessName: powershell.exe
                    Sigma detected: Suspicious Outbound SMTP Connections
                    Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 78.110.166.82, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Quote GVSE24-00815.exe, Initiated: true, ProcessId: 3732, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49737
                    Sigma detected: Non Interactive PowerShell Process Spawned
                    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Quote GVSE24-00815.exe", ParentImage: C:\Users\user\Desktop\Quote GVSE24-00815.exe, ParentProcessId: 6260, ParentProcessName: Quote GVSE24-00815.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe", ProcessId: 5304, ProcessName: powershell.exe

                    Suricata Signatures

                    ⊘No Suricata rule has matched

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Found malware configuration
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.zqamcx.com", "Username": "servertwo@zqamcx.com", "Password": "Anambraeast@"}
                    Multi AV Scanner detection for domain / URL
                    Source: mail.zqamcx.comVirustotal: Detection: 13%Perma Link
                    Multi AV Scanner detection for submitted file
                    Source: Quote GVSE24-00815.exeReversingLabs: Detection: 73%
                    Source: Quote GVSE24-00815.exeVirustotal: Detection: 74%Perma Link
                    AI detected suspicious sample
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                    Machine Learning detection for sample
                    Source: Quote GVSE24-00815.exeJoe Sandbox ML: detected
                    Source: Quote GVSE24-00815.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: Quote GVSE24-00815.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                    Networking

                    barindex
                    Yara detected Generic Downloader
                    Source: Yara matchFile source: 4.2.Quote GVSE24-00815.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, type: UNPACKEDPE
                    Source: global trafficTCP traffic: 192.168.2.4:49737 -> 78.110.166.82:587
                    Source: global trafficHTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
                    Source: Joe Sandbox ViewIP Address: 208.95.112.1 208.95.112.1
                    Source: Joe Sandbox ViewIP Address: 78.110.166.82 78.110.166.82
                    Source: unknownDNS query: name: ip-api.com
                    Source: global trafficTCP traffic: 192.168.2.4:49737 -> 78.110.166.82:587
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: global trafficHTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
                    Source: global trafficDNS traffic detected: DNS query: ip-api.com
                    Source: global trafficDNS traffic detected: DNS query: mail.zqamcx.com
                    Source: Quote GVSE24-00815.exeString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
                    Source: Quote GVSE24-00815.exeString found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1709737330.0000000003749000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/line/?fields=hosting
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mail.zqamcx.com
                    Source: Quote GVSE24-00815.exeString found in binary or memory: http://ocsp.comodoca.com0
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137921930.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4143010272.00000000068D2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://r11.i.lencr.org/0#
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137921930.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4143010272.00000000068D2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://r11.o.lencr.org0#
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1707813519.000000000279A000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                    Source: Quote GVSE24-00815.exeString found in binary or memory: http://tempuri.org/ianiDataSet.xsd
                    Source: Quote GVSE24-00815.exeString found in binary or memory: http://tempuri.org/ianiDataSet1.xsd
                    Source: Quote GVSE24-00815.exeString found in binary or memory: http://tempuri.org/ianiDataSet2.xsdM
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137921930.0000000000FC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137921930.0000000000FC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://zqamcx.com
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1709737330.0000000003749000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://account.dyn.com/
                    Source: Quote GVSE24-00815.exeString found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

                    Key, Mouse, Clipboard, Microphone and Screen Capturing

                    barindex
                    Contains functionality to log keystrokes (.Net Source)
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, n00.cs.Net Code: O5ZNXKF
                    Source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.raw.unpack, n00.cs.Net Code: O5ZNXKF
                    Installs a global keyboard hook
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\Quote GVSE24-00815.exeJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 4.2.Quote GVSE24-00815.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_00E3D51C0_2_00E3D51C
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_04CA6BE00_2_04CA6BE0
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_04CA00400_2_04CA0040
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_04CA003F0_2_04CA003F
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_04CA6BDA0_2_04CA6BDA
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_04CA6BD10_2_04CA6BD1
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_06E5AF680_2_06E5AF68
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_06E56ED00_2_06E56ED0
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_06E54FA70_2_06E54FA7
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_06E54FB80_2_06E54FB8
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_06E56A880_2_06E56A88
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_06E56A980_2_06E56A98
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_06E553F00_2_06E553F0
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_06E54B800_2_06E54B80
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_02D0E5A84_2_02D0E5A8
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_02D04BF04_2_02D04BF0
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_02D0EE214_2_02D0EE21
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_02D03FD84_2_02D03FD8
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_02D0B3184_2_02D0B318
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_02D043204_2_02D04320
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_069C2B544_2_069C2B54
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_069C21684_2_069C2168
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_069C21634_2_069C2163
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_069C2B484_2_069C2B48
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_069C32664_2_069C3266
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A256804_2_06A25680
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A266C84_2_06A266C8
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A2B2F94_2_06A2B2F9
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A2C2404_2_06A2C240
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A231484_2_06A23148
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A27E504_2_06A27E50
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A277704_2_06A27770
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A2E4584_2_06A2E458
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A200404_2_06A20040
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A25DBB4_2_06A25DBB
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A200074_2_06A20007
                    Source: Quote GVSE24-00815.exeStatic PE information: invalid certificate
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1707813519.00000000027A5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameArthur.dll" vs Quote GVSE24-00815.exe
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1714917912.0000000007210000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs Quote GVSE24-00815.exe
                    Source: Quote GVSE24-00815.exe, 00000000.00000000.1678802457.0000000000332000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameOwfV.exe4 vs Quote GVSE24-00815.exe
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1707813519.000000000279A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamee33f29a3-d982-4bbb-b145-e4c33ad27d5d.exe4 vs Quote GVSE24-00815.exe
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1713162820.0000000004F60000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameArthur.dll" vs Quote GVSE24-00815.exe
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1706918857.0000000000A4E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Quote GVSE24-00815.exe
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1709737330.0000000003749000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamee33f29a3-d982-4bbb-b145-e4c33ad27d5d.exe4 vs Quote GVSE24-00815.exe
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1709737330.0000000003749000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs Quote GVSE24-00815.exe
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: OriginalFilenamee33f29a3-d982-4bbb-b145-e4c33ad27d5d.exe4 vs Quote GVSE24-00815.exe
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4137861344.0000000000F39000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs Quote GVSE24-00815.exe
                    Source: Quote GVSE24-00815.exeBinary or memory string: OriginalFilenameOwfV.exe4 vs Quote GVSE24-00815.exe
                    Source: Quote GVSE24-00815.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: 4.2.Quote GVSE24-00815.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: Quote GVSE24-00815.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, NpXw3kw.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, NpXw3kw.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, gyfrCFT5x9I.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, gyfrCFT5x9I.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, gyfrCFT5x9I.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, gyfrCFT5x9I.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, fpnV0Qjz.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, fpnV0Qjz.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, UjM08uKG4ajvp16R40.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, UjM08uKG4ajvp16R40.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, xKiWxFkKk1hXKZ6pNR.csSecurity API names: _0020.SetAccessControl
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, xKiWxFkKk1hXKZ6pNR.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, xKiWxFkKk1hXKZ6pNR.csSecurity API names: _0020.AddAccessRule
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, xKiWxFkKk1hXKZ6pNR.csSecurity API names: _0020.SetAccessControl
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, xKiWxFkKk1hXKZ6pNR.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, xKiWxFkKk1hXKZ6pNR.csSecurity API names: _0020.AddAccessRule
                    Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/6@3/2
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quote GVSE24-00815.exe.logJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMutant created: NULL
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5016:120:WilError_03
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tjgib2nb.30d.ps1Jump to behavior
                    Source: Quote GVSE24-00815.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: Quote GVSE24-00815.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: Quote GVSE24-00815.exe, 00000000.00000000.1678802457.0000000000332000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO [dbo].[CREDIT_PLAN] ([CREDIT_ID], [MATURITY_DATE], [MATURITY_SUM], [MATURITY_NOTE], [MODIF_DATE]) VALUES (@CREDIT_ID, @MATURITY_DATE, @MATURITY_SUM, @MATURITY_NOTE, @MODIF_DATE);
                    Source: Quote GVSE24-00815.exe, 00000000.00000000.1678802457.0000000000332000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO [dbo].[CREDIT_PRODUCT] ([PROD_NAME], [PROD_ACTIVE], [PROD_SUM_FROM], [PROD_SUM_TO], [MODIF_DATE], [INTEREST]) VALUES (@PROD_NAME, @PROD_ACTIVE, @PROD_SUM_FROM, @PROD_SUM_TO, @MODIF_DATE, @INTEREST);
                    Source: Quote GVSE24-00815.exe, 00000000.00000000.1678802457.0000000000332000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE [dbo].[Login] SET [User_id] = @User_id, [User_pass] = @User_pass WHERE (([User_id] = @Original_User_id) AND ([User_pass] = @Original_User_pass));
                    Source: Quote GVSE24-00815.exe, 00000000.00000000.1678802457.0000000000332000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE [dbo].[CREDIT_PLAN] SET [CREDIT_ID] = @CREDIT_ID, [MATURITY_DATE] = @MATURITY_DATE, [MATURITY_SUM] = @MATURITY_SUM, [MATURITY_NOTE] = @MATURITY_NOTE, [MODIF_DATE] = @MODIF_DATE WHERE (([MATURITY_ID] = @Original_MATURITY_ID) AND ((@IsNull_CREDIT_ID = 1 AND [CREDIT_ID] IS NULL) OR ([CREDIT_ID] = @Original_CREDIT_ID)) AND ([MATURITY_DATE] = @Original_MATURITY_DATE) AND ([MATURITY_SUM] = @Original_MATURITY_SUM) AND ((@IsNull_MATURITY_NOTE = 1 AND [MATURITY_NOTE] IS NULL) OR ([MATURITY_NOTE] = @Original_MATURITY_NOTE)) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
                    Source: Quote GVSE24-00815.exe, 00000000.00000000.1678802457.0000000000332000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO [dbo].[PROD_PERIODS] ([PROD_CODE], [PROD_PERIOD]) VALUES (@PROD_CODE, @PROD_PERIOD);
                    Source: Quote GVSE24-00815.exe, 00000000.00000000.1678802457.0000000000332000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE [dbo].[INTEREST] SET [PROD_CODE] = @PROD_CODE, [PROD_PERIOD] = @PROD_PERIOD, [SUM_FROM] = @SUM_FROM, [SUM_TO] = @SUM_TO WHERE (([PROD_CODE] = @Original_PROD_CODE) AND ([PROD_PERIOD] = @Original_PROD_PERIOD) AND ([SUM_FROM] = @Original_SUM_FROM) AND ([SUM_TO] = @Original_SUM_TO));
                    Source: Quote GVSE24-00815.exe, 00000000.00000000.1678802457.0000000000332000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE [dbo].[CREDIT] SET [CREDIT_NO] = @CREDIT_NO, [CREDIT_DATE] = @CREDIT_DATE, [CREDIT_PERIOD] = @CREDIT_PERIOD, [CREDIT_END_DATE] = @CREDIT_END_DATE, [CREDIT_BEGIN_DATE] = @CREDIT_BEGIN_DATE, [CLIENT_ID] = @CLIENT_ID, [PROD_CODE] = @PROD_CODE, [CREDIT_SUM] = @CREDIT_SUM, [CREDIT_NOTE] = @CREDIT_NOTE, [MODIF_DATE] = @MODIF_DATE WHERE (([CREDIT_ID] = @Original_CREDIT_ID) AND ([CREDIT_NO] = @Original_CREDIT_NO) AND ((@IsNull_CREDIT_DATE = 1 AND [CREDIT_DATE] IS NULL) OR ([CREDIT_DATE] = @Original_CREDIT_DATE)) AND ([CREDIT_PERIOD] = @Original_CREDIT_PERIOD) AND ((@IsNull_CREDIT_END_DATE = 1 AND [CREDIT_END_DATE] IS NULL) OR ([CREDIT_END_DATE] = @Original_CREDIT_END_DATE)) AND ((@IsNull_CREDIT_BEGIN_DATE = 1 AND [CREDIT_BEGIN_DATE] IS NULL) OR ([CREDIT_BEGIN_DATE] = @Original_CREDIT_BEGIN_DATE)) AND ([CLIENT_ID] = @Original_CLIENT_ID) AND ((@IsNull_PROD_CODE = 1 AND [PROD_CODE] IS NULL) OR ([PROD_CODE] = @Original_PROD_CODE)) AND ([CREDIT_SUM] = @Original_CREDIT_SUM) AND ((@IsNull_CREDIT_NOTE = 1 AND [CREDIT_NOTE] IS NULL) OR ([CREDIT_NOTE] = @Original_CREDIT_NOTE)) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
                    Source: Quote GVSE24-00815.exe, 00000000.00000000.1678802457.0000000000332000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE [dbo].[CREDIT_PRODUCT] SET [PROD_NAME] = @PROD_NAME, [PROD_ACTIVE] = @PROD_ACTIVE, [PROD_SUM_FROM] = @PROD_SUM_FROM, [PROD_SUM_TO] = @PROD_SUM_TO, [MODIF_DATE] = @MODIF_DATE WHERE (([PROD_CODE] = @Original_PROD_CODE) AND ([PROD_NAME] = @Original_PROD_NAME) AND ([PROD_ACTIVE] = @Original_PROD_ACTIVE) AND ([PROD_SUM_FROM] = @Original_PROD_SUM_FROM) AND ([PROD_SUM_TO] = @Original_PROD_SUM_TO) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
                    Source: Quote GVSE24-00815.exe, 00000000.00000000.1678802457.0000000000332000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO [dbo].[CREDIT_PRODUCT] ([PROD_NAME], [PROD_ACTIVE], [PROD_SUM_FROM], [PROD_SUM_TO], [MODIF_DATE]) VALUES (@PROD_NAME, @PROD_ACTIVE, @PROD_SUM_FROM, @PROD_SUM_TO, @MODIF_DATE);
                    Source: Quote GVSE24-00815.exeReversingLabs: Detection: 73%
                    Source: Quote GVSE24-00815.exeVirustotal: Detection: 74%
                    Source: unknownProcess created: C:\Users\user\Desktop\Quote GVSE24-00815.exe "C:\Users\user\Desktop\Quote GVSE24-00815.exe"
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe"
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess created: C:\Users\user\Desktop\Quote GVSE24-00815.exe "C:\Users\user\Desktop\Quote GVSE24-00815.exe"
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess created: C:\Users\user\Desktop\Quote GVSE24-00815.exe "C:\Users\user\Desktop\Quote GVSE24-00815.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: dwrite.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: rasapi32.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: rasman.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: rtutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: dhcpcsvc6.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: dhcpcsvc.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: vaultcli.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\ProfilesJump to behavior
                    Source: Quote GVSE24-00815.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                    Source: Quote GVSE24-00815.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                    Data Obfuscation

                    barindex
                    .NET source code contains potential unpacker
                    Source: Quote GVSE24-00815.exe, InnerForm.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, xKiWxFkKk1hXKZ6pNR.cs.Net Code: CVZ6Zttube System.Reflection.Assembly.Load(byte[])
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, xKiWxFkKk1hXKZ6pNR.cs.Net Code: CVZ6Zttube System.Reflection.Assembly.Load(byte[])
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_04CAA05B push es; retf 0_2_04CAA062
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_04CAA058 push es; retf 0_2_04CAA05A
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_04CA9ED7 push es; retf 0_2_04CA9EDA
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_04CA9E68 push es; retf 0_2_04CA9E72
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 0_2_06E5AF68 pushfd ; retn 5504h0_2_06E5B696
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_02D00610 push edx; ret 4_2_02D0061A
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_02D0061B push edx; ret 4_2_02D0061A
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_02D00828 push edx; ret 4_2_02D00846
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_02D0F9B8 push edx; ret 4_2_02D0F9C6
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_069C7782 push es; ret 4_2_069C7790
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_06A24240 pushfd ; ret 4_2_06A24285
                    Source: Quote GVSE24-00815.exeStatic PE information: section name: .text entropy: 7.52645497703216
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, udp8Y54h5tL0mZ8Mad.csHigh entropy of concatenated method names: 'xo53mFR5Pb', 'Dl13xRMVb9', 'Aiu31rKNWY', 'CaZ3tgmlia', 'MIJ3BiytcU', 'DgZ3n3ompG', 'wt232G3qko', 'spd3sNyUyZ', 'V493vYIhO4', 'nl93M2bppV'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, wKjoyMa13ZFUm17qsv.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'JB3G4aRqMH', 'lDFGcfxEnT', 'ivrGzpxNv3', 'WaE9UJD666', 'nna9QuYksT', 'SHv9GlqZ1d', 'cpS993OTdQ', 'u79KBkcchGK97Or60Bo'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, eDGCCDzpNSnLU0NOIS.csHigh entropy of concatenated method names: 'QsiyT9NHki', 'ziMyKBAVuD', 'HFyyuc9VMd', 'hQsymKSObc', 'aJByxUoYU7', 'wdgytfcT9s', 'QL0yB3L1Bb', 'TWXyYCOOfn', 'nWxyjwdoEb', 'r9uyFHKL9n'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, nrLAxkVO6F2gBrQSmN.csHigh entropy of concatenated method names: 'Dispose', 'bnfQ4KQPt3', 'TCBGx687bB', 'NMBvt5KyGc', 'jXJQcONtUx', 'I86QzibNLU', 'ProcessDialogKey', 'jAqGUdp8Y5', 'S5tGQL0mZ8', 'OadGG8sAfy'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, nsAfyYcOq9jOlSjV4n.csHigh entropy of concatenated method names: 'ReLyaLkipa', 'KAlyRpcIXU', 'RjdyIoyZWO', 'BNqyiTreMA', 'xumy3la7xW', 'BOYykDFbPT', 'Next', 'Next', 'Next', 'NextBytes'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, oNX8UtW5SQnfKQPt3I.csHigh entropy of concatenated method names: 'wAi3L3VHvJ', 'bbc3DFxHyT', 'i2C33kMEMJ', 'cC83lPZvLG', 'kH33gIfDZk', 'u7I3YHX1oD', 'Dispose', 'LkL0CYEyED', 'oE60Vl0Knd', 'J9Z0aqADwb'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, CYyUhDHuwnyg49OWYm.csHigh entropy of concatenated method names: 'VxcDJlxpP7', 'xMFD7h8b70', 'ToString', 'KlZDCkIhyO', 'XeSDVSOFJc', 'f06Dai8416', 'Mu8DRKcbWW', 'ra9DI5wi1l', 'uvGDiwvFkC', 'h00DkYZpiV'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, yJ3SUFudKvLKAR53HS.csHigh entropy of concatenated method names: 'dEIaP0pJZ0', 'jQqaT55VeD', 'F1oaKOKLeo', 'pykauXSrbf', 'DyqaLT9sA8', 'YKKablUXcb', 'TdPaDhsorc', 'f5Sa0jZrAf', 'Ct3a3Bt4K4', 'CJLayYrrnv'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, xewm1LfuAOibrAUReG.csHigh entropy of concatenated method names: 'Fb7DplFtte', 'AKHDcfDift', 'RNt0UBoHcN', 'V9F0QTnVUk', 'nVyD5eXohK', 'Y9EDSUV1rw', 'qZBDdcCrm4', 'PwUDejZ7eE', 'mesDh2O0Zh', 'SZqDOuf8sm'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, Qp49reO0iYlVrX1hL0.csHigh entropy of concatenated method names: 'ToString', 'Qk4b58HrGt', 'b6abxVNLZs', 'LRSb1EjhUO', 'CoUbtbOFuN', 'X2SbBUEmxE', 'a4PbnEe9up', 'SeUb2YNxqC', 'PtZbsf1nFb', 'kS5bvAW5Lj'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, cxIuTXvufT3YjfmZai.csHigh entropy of concatenated method names: 'bWEijKHDVE', 'xs5iFcjDTa', 'HCriZ4qt7H', 'VA9iPDxI05', 'tx1irvc88c', 'jH6iTUZGXp', 'vQSiNDN6CH', 'f63iKvKKHb', 'xGKiu0cbWf', 'jBwiAaNP3C'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, p6cOn4QUBKJCgoeIhgy.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't86y5udrZa', 'w9IyS13XoS', 'OA9ydxH77G', 'TmKyeD8M25', 'sxxyhE8WOy', 'kU2yOim9mF', 'r3dyHpanPw'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, bK4b3KAvZGw9eMXbdL.csHigh entropy of concatenated method names: 'YpJRrcd4GY', 'RQ7RN7hcHR', 'NyHa1nqHUp', 'fHRatAFDfy', 'TKraBULGhK', 'HBCanIndOn', 'y9ra2JKRNb', 'RUXask2ApG', 'zwyavcPviJ', 'jgNaMTHdcb'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, Qlb0EcQG6HwJhj28G0A.csHigh entropy of concatenated method names: 'ToString', 'L4SlKLMYie', 'oVUlu27DGe', 'BaRlALOFbo', 'b2WlmNVPEv', 'Hemlxp5rUS', 'utHl1rljJ8', 'LwqltXxMPH', 'PeTQASNmpOlUwN9cZI3', 'yc6TtRNs932U9Xi96LT'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, GaO88nQQyuNgJMDLivT.csHigh entropy of concatenated method names: 'USTycolJgX', 'VNsyz7v9J4', 'BMXlUMxTob', 'snClQL8bMn', 'WSUlG6wtni', 'awGl9twXtW', 'Iy6l6x3nWw', 'SGSlwDr7Pm', 'eEllCgy6Qn', 'jDylVUnImd'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, XlB4bpGkjFAiOUtBKw.csHigh entropy of concatenated method names: 'fkmZ1S6X1', 'uLZP8xli0', 'PtdTBuhEC', 'zCxNCt6Gb', 'fxfuTUioG', 'zunAlIZOQ', 'qdAFn5sGP79qtQGeOI', 'jiwXfa9uQgjy1ChERP', 'qXr08JABP', 'NlKyIcG21'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, aqWHQt2o2GTW94fMH6.csHigh entropy of concatenated method names: 'FEiiC9BgTS', 'hhsia0VJeq', 'EbqiICyYST', 'JqcIciBaNm', 'G5BIzGd5Fd', 'sbgiUbtJXk', 'GfViQT7ccy', 'NEviGUbAfO', 'RXui9uZEwJ', 'RYSi6jwwAj'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, mVrobKdKMaMT4VBm14.csHigh entropy of concatenated method names: 'iM28KdCKKW', 'oa08uv7eUt', 'oih8m9F332', 'n6k8xX72Mu', 'ydC8t4DvNl', 'Cj48BZ3OqH', 'CPK82ttQ5M', 'eio8sUVw4G', 'kQT8MAdBN0', 'Xlo85xYmdR'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, S3SW7Nm5yZfAI7L9f4.csHigh entropy of concatenated method names: 'a7DIwgSEJb', 'sdyIV16KIl', 'FIUIR8r8Qa', 'De0Ii9CEg7', 'BeZIkQIMlL', 'iLXRExSCIU', 'RotRf0II9v', 'IqWRWQaJ4N', 'NbARpvdTjn', 'L6UR4GRTpc'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, RZR926Q6EssYSwiVRUZ.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'oQmq3rrYCt', 'FXDqyRKprj', 'ptHqlfpm0P', 'kLRqqHZjXY', 'tlOqg45ZOR', 'A3ZqXVI5Ho', 'HGiqYkE6gT'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, xKiWxFkKk1hXKZ6pNR.csHigh entropy of concatenated method names: 'fJh9wZ4UQZ', 'ECb9Cu9m0R', 'QmA9VsSZ5l', 'b4G9alyvVG', 'SlP9RWgSB6', 'Yo49I31oBH', 'nkh9iiIphg', 'OBQ9kZgp4O', 'bC59oHNbj3', 'jgM9JSA0NY'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, UjM08uKG4ajvp16R40.csHigh entropy of concatenated method names: 'WV8Veu8y1s', 'rF5Vheso9s', 'kLTVODKD55', 'KTwVHprYHq', 'e6iVE2obgH', 'Hw2VfDSQ6x', 'O9FVWcGG7Z', 'OZfVpAwcm6', 'NJdV4gj3Bu', 'FJMVckNOMe'
                    Source: 0.2.Quote GVSE24-00815.exe.7210000.4.raw.unpack, Tj4hrN6Og75w16Grr1.csHigh entropy of concatenated method names: 'W9EQijM08u', 'b4aQkjvp16', 'ydKQJvLKAR', 'O3HQ7SQK4b', 'NXbQLdLO3S', 'W7NQb5yZfA', 'Bw0vOUqBHw97S38uAc', 'e0t0XPwWN6xxjDXGKs', 'oJ4QQIG98E', 'cuKQ9RKkIo'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, udp8Y54h5tL0mZ8Mad.csHigh entropy of concatenated method names: 'xo53mFR5Pb', 'Dl13xRMVb9', 'Aiu31rKNWY', 'CaZ3tgmlia', 'MIJ3BiytcU', 'DgZ3n3ompG', 'wt232G3qko', 'spd3sNyUyZ', 'V493vYIhO4', 'nl93M2bppV'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, wKjoyMa13ZFUm17qsv.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'JB3G4aRqMH', 'lDFGcfxEnT', 'ivrGzpxNv3', 'WaE9UJD666', 'nna9QuYksT', 'SHv9GlqZ1d', 'cpS993OTdQ', 'u79KBkcchGK97Or60Bo'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, eDGCCDzpNSnLU0NOIS.csHigh entropy of concatenated method names: 'QsiyT9NHki', 'ziMyKBAVuD', 'HFyyuc9VMd', 'hQsymKSObc', 'aJByxUoYU7', 'wdgytfcT9s', 'QL0yB3L1Bb', 'TWXyYCOOfn', 'nWxyjwdoEb', 'r9uyFHKL9n'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, nrLAxkVO6F2gBrQSmN.csHigh entropy of concatenated method names: 'Dispose', 'bnfQ4KQPt3', 'TCBGx687bB', 'NMBvt5KyGc', 'jXJQcONtUx', 'I86QzibNLU', 'ProcessDialogKey', 'jAqGUdp8Y5', 'S5tGQL0mZ8', 'OadGG8sAfy'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, nsAfyYcOq9jOlSjV4n.csHigh entropy of concatenated method names: 'ReLyaLkipa', 'KAlyRpcIXU', 'RjdyIoyZWO', 'BNqyiTreMA', 'xumy3la7xW', 'BOYykDFbPT', 'Next', 'Next', 'Next', 'NextBytes'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, oNX8UtW5SQnfKQPt3I.csHigh entropy of concatenated method names: 'wAi3L3VHvJ', 'bbc3DFxHyT', 'i2C33kMEMJ', 'cC83lPZvLG', 'kH33gIfDZk', 'u7I3YHX1oD', 'Dispose', 'LkL0CYEyED', 'oE60Vl0Knd', 'J9Z0aqADwb'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, CYyUhDHuwnyg49OWYm.csHigh entropy of concatenated method names: 'VxcDJlxpP7', 'xMFD7h8b70', 'ToString', 'KlZDCkIhyO', 'XeSDVSOFJc', 'f06Dai8416', 'Mu8DRKcbWW', 'ra9DI5wi1l', 'uvGDiwvFkC', 'h00DkYZpiV'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, yJ3SUFudKvLKAR53HS.csHigh entropy of concatenated method names: 'dEIaP0pJZ0', 'jQqaT55VeD', 'F1oaKOKLeo', 'pykauXSrbf', 'DyqaLT9sA8', 'YKKablUXcb', 'TdPaDhsorc', 'f5Sa0jZrAf', 'Ct3a3Bt4K4', 'CJLayYrrnv'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, xewm1LfuAOibrAUReG.csHigh entropy of concatenated method names: 'Fb7DplFtte', 'AKHDcfDift', 'RNt0UBoHcN', 'V9F0QTnVUk', 'nVyD5eXohK', 'Y9EDSUV1rw', 'qZBDdcCrm4', 'PwUDejZ7eE', 'mesDh2O0Zh', 'SZqDOuf8sm'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, Qp49reO0iYlVrX1hL0.csHigh entropy of concatenated method names: 'ToString', 'Qk4b58HrGt', 'b6abxVNLZs', 'LRSb1EjhUO', 'CoUbtbOFuN', 'X2SbBUEmxE', 'a4PbnEe9up', 'SeUb2YNxqC', 'PtZbsf1nFb', 'kS5bvAW5Lj'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, cxIuTXvufT3YjfmZai.csHigh entropy of concatenated method names: 'bWEijKHDVE', 'xs5iFcjDTa', 'HCriZ4qt7H', 'VA9iPDxI05', 'tx1irvc88c', 'jH6iTUZGXp', 'vQSiNDN6CH', 'f63iKvKKHb', 'xGKiu0cbWf', 'jBwiAaNP3C'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, p6cOn4QUBKJCgoeIhgy.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't86y5udrZa', 'w9IyS13XoS', 'OA9ydxH77G', 'TmKyeD8M25', 'sxxyhE8WOy', 'kU2yOim9mF', 'r3dyHpanPw'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, bK4b3KAvZGw9eMXbdL.csHigh entropy of concatenated method names: 'YpJRrcd4GY', 'RQ7RN7hcHR', 'NyHa1nqHUp', 'fHRatAFDfy', 'TKraBULGhK', 'HBCanIndOn', 'y9ra2JKRNb', 'RUXask2ApG', 'zwyavcPviJ', 'jgNaMTHdcb'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, Qlb0EcQG6HwJhj28G0A.csHigh entropy of concatenated method names: 'ToString', 'L4SlKLMYie', 'oVUlu27DGe', 'BaRlALOFbo', 'b2WlmNVPEv', 'Hemlxp5rUS', 'utHl1rljJ8', 'LwqltXxMPH', 'PeTQASNmpOlUwN9cZI3', 'yc6TtRNs932U9Xi96LT'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, GaO88nQQyuNgJMDLivT.csHigh entropy of concatenated method names: 'USTycolJgX', 'VNsyz7v9J4', 'BMXlUMxTob', 'snClQL8bMn', 'WSUlG6wtni', 'awGl9twXtW', 'Iy6l6x3nWw', 'SGSlwDr7Pm', 'eEllCgy6Qn', 'jDylVUnImd'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, XlB4bpGkjFAiOUtBKw.csHigh entropy of concatenated method names: 'fkmZ1S6X1', 'uLZP8xli0', 'PtdTBuhEC', 'zCxNCt6Gb', 'fxfuTUioG', 'zunAlIZOQ', 'qdAFn5sGP79qtQGeOI', 'jiwXfa9uQgjy1ChERP', 'qXr08JABP', 'NlKyIcG21'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, aqWHQt2o2GTW94fMH6.csHigh entropy of concatenated method names: 'FEiiC9BgTS', 'hhsia0VJeq', 'EbqiICyYST', 'JqcIciBaNm', 'G5BIzGd5Fd', 'sbgiUbtJXk', 'GfViQT7ccy', 'NEviGUbAfO', 'RXui9uZEwJ', 'RYSi6jwwAj'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, mVrobKdKMaMT4VBm14.csHigh entropy of concatenated method names: 'iM28KdCKKW', 'oa08uv7eUt', 'oih8m9F332', 'n6k8xX72Mu', 'ydC8t4DvNl', 'Cj48BZ3OqH', 'CPK82ttQ5M', 'eio8sUVw4G', 'kQT8MAdBN0', 'Xlo85xYmdR'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, S3SW7Nm5yZfAI7L9f4.csHigh entropy of concatenated method names: 'a7DIwgSEJb', 'sdyIV16KIl', 'FIUIR8r8Qa', 'De0Ii9CEg7', 'BeZIkQIMlL', 'iLXRExSCIU', 'RotRf0II9v', 'IqWRWQaJ4N', 'NbARpvdTjn', 'L6UR4GRTpc'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, RZR926Q6EssYSwiVRUZ.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'oQmq3rrYCt', 'FXDqyRKprj', 'ptHqlfpm0P', 'kLRqqHZjXY', 'tlOqg45ZOR', 'A3ZqXVI5Ho', 'HGiqYkE6gT'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, xKiWxFkKk1hXKZ6pNR.csHigh entropy of concatenated method names: 'fJh9wZ4UQZ', 'ECb9Cu9m0R', 'QmA9VsSZ5l', 'b4G9alyvVG', 'SlP9RWgSB6', 'Yo49I31oBH', 'nkh9iiIphg', 'OBQ9kZgp4O', 'bC59oHNbj3', 'jgM9JSA0NY'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, UjM08uKG4ajvp16R40.csHigh entropy of concatenated method names: 'WV8Veu8y1s', 'rF5Vheso9s', 'kLTVODKD55', 'KTwVHprYHq', 'e6iVE2obgH', 'Hw2VfDSQ6x', 'O9FVWcGG7Z', 'OZfVpAwcm6', 'NJdV4gj3Bu', 'FJMVckNOMe'
                    Source: 0.2.Quote GVSE24-00815.exe.39de2e0.1.raw.unpack, Tj4hrN6Og75w16Grr1.csHigh entropy of concatenated method names: 'W9EQijM08u', 'b4aQkjvp16', 'ydKQJvLKAR', 'O3HQ7SQK4b', 'NXbQLdLO3S', 'W7NQb5yZfA', 'Bw0vOUqBHw97S38uAc', 'e0t0XPwWN6xxjDXGKs', 'oJ4QQIG98E', 'cuKQ9RKkIo'

                    Hooking and other Techniques for Hiding and Protection

                    barindex
                    Loading BitLocker PowerShell Module
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                    Malware Analysis System Evasion

                    barindex
                    Yara detected AntiVM3
                    Source: Yara matchFile source: Process Memory Space: Quote GVSE24-00815.exe PID: 6260, type: MEMORYSTR
                    Check if machine is in data center or colocation facility
                    Source: global trafficHTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
                    Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                    Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                    Source: Quote GVSE24-00815.exe, 00000000.00000002.1709737330.0000000003749000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002E95000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory allocated: D90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory allocated: 2740000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory allocated: D90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory allocated: 7610000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory allocated: 8610000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory allocated: 87C0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory allocated: 97C0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory allocated: 2CC0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory allocated: 2E60000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory allocated: 4E60000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7326Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2336Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWindow / User API: threadDelayed 1344Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWindow / User API: threadDelayed 8512Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 2172Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7188Thread sleep time: -3689348814741908s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -27670116110564310s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -100000s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7280Thread sleep count: 1344 > 30Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -99875s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7280Thread sleep count: 8512 > 30Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -99766s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -99656s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -99547s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -99437s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -99328s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -99219s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -99094s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -98984s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -98875s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -98766s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -98656s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -98547s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -98437s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -98328s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -98218s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -98109s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -98000s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -97890s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -97781s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -97672s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -97547s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -97437s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -97328s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -97219s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -97094s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -96984s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -96875s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -96766s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -96656s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -96547s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -96435s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -96328s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -96219s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -96109s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -96000s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -95888s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -95781s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -95672s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -95562s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -95453s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -95344s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -95234s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -95125s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -95016s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -94906s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -94797s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -94687s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exe TID: 7276Thread sleep time: -94578s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 100000Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 99875Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 99766Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 99656Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 99547Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 99437Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 99328Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 99219Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 99094Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 98984Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 98875Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 98766Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 98656Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 98547Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 98437Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 98328Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 98218Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 98109Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 98000Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 97890Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 97781Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 97672Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 97547Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 97437Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 97328Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 97219Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 97094Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 96984Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 96875Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 96766Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 96656Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 96547Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 96435Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 96328Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 96219Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 96109Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 96000Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 95888Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 95781Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 95672Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 95562Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 95453Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 95344Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 95234Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 95125Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 95016Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 94906Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 94797Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 94687Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeThread delayed: delay time: 94578Jump to behavior
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002E95000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4137921930.0000000000FC7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002E95000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
                    Source: Quote GVSE24-00815.exe, 00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

                    Anti Debugging

                    barindex
                    Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeCode function: 4_2_02D071D8 CheckRemoteDebuggerPresent,4_2_02D071D8
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory allocated: page read and write | page guardJump to behavior

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Adds a directory exclusion to Windows Defender
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe"
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe"Jump to behavior
                    Injects a PE file into a foreign processes
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeMemory written: C:\Users\user\Desktop\Quote GVSE24-00815.exe base: 400000 value starts with: 4D5AJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeProcess created: C:\Users\user\Desktop\Quote GVSE24-00815.exe "C:\Users\user\Desktop\Quote GVSE24-00815.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Users\user\Desktop\Quote GVSE24-00815.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Users\user\Desktop\Quote GVSE24-00815.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                    Stealing of Sensitive Information

                    barindex
                    Yara detected AgentTesla
                    Source: Yara matchFile source: 4.2.Quote GVSE24-00815.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000004.00000002.4139084542.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000004.00000002.4139084542.0000000002EC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000004.00000002.4139084542.0000000002E95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1709737330.0000000003749000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: Quote GVSE24-00815.exe PID: 6260, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: Quote GVSE24-00815.exe PID: 3732, type: MEMORYSTR
                    Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                    Tries to harvest and steal browser information (history, passwords, etc)
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeFile opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.iniJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeFile opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.iniJump to behavior
                    Tries to harvest and steal ftp login credentials
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeFile opened: C:\FTP Navigator\Ftplist.txtJump to behavior
                    Tries to steal Mail credentials (via file / registry access)
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
                    Source: C:\Users\user\Desktop\Quote GVSE24-00815.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                    Source: Yara matchFile source: 4.2.Quote GVSE24-00815.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000004.00000002.4139084542.0000000002E95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1709737330.0000000003749000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: Quote GVSE24-00815.exe PID: 6260, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: Quote GVSE24-00815.exe PID: 3732, type: MEMORYSTR

                    Remote Access Functionality

                    barindex
                    Yara detected AgentTesla
                    Source: Yara matchFile source: 4.2.Quote GVSE24-00815.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.399a0e0.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.Quote GVSE24-00815.exe.395e2c0.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000004.00000002.4139084542.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000004.00000002.4139084542.0000000002EC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000004.00000002.4139084542.0000000002E95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1709737330.0000000003749000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: Quote GVSE24-00815.exe PID: 6260, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: Quote GVSE24-00815.exe PID: 3732, type: MEMORYSTR

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid Accounts231
                    Windows Management Instrumentation                    		1
                    DLL Side-Loading                    		1
                    DLL Side-Loading                    		11
                    Disable or Modify Tools                    		2
                    OS Credential Dumping                    		1
                    File and Directory Discovery                    		Remote Services11
                    Archive Collected Data                    		1
                    Ingress Tool Transfer                    		Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts111
                    Process Injection                    		1
                    Deobfuscate/Decode Files or Information                    		21
                    Input Capture                    		34
                    System Information Discovery                    		Remote Desktop Protocol2
                    Data from Local System                    		1
                    Encrypted Channel                    		Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)2
                    Obfuscated Files or Information                    		1
                    Credentials in Registry                    		1
                    Query Registry                    		SMB/Windows Admin Shares1
                    Email Collection                    		1
                    Non-Standard Port                    		Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook12
                    Software Packing                    		NTDS531
                    Security Software Discovery                    		Distributed Component Object Model21
                    Input Capture                    		2
                    Non-Application Layer Protocol                    		Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                    DLL Side-Loading                    		LSA Secrets1
                    Process Discovery                    		SSH1
                    Clipboard Data                    		12
                    Application Layer Protocol                    		Scheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                    Masquerading                    		Cached Domain Credentials261
                    Virtualization/Sandbox Evasion                    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items261
                    Virtualization/Sandbox Evasion                    		DCSync1
                    Application Window Discovery                    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job111
                    Process Injection                    		Proc Filesystem1
                    System Network Configuration Discovery                    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    Quote GVSE24-00815.exe74%ReversingLabsWin32.Trojan.AgentTesla
                    Quote GVSE24-00815.exe74%VirustotalBrowse
                    Quote GVSE24-00815.exe100%Joe Sandbox ML

                    Dropped Files

                    ⊘No Antivirus matches

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    SourceDetectionScannerLabelLink
                    mail.zqamcx.com14%VirustotalBrowse

                    URLs

                    ⊘No Antivirus matches

                    Domains and IPs

                    Contacted Domains

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    zqamcx.com
                    		78.110.166.82
                    		truefalse
                      		high
                      ip-api.com
                      		208.95.112.1
                      		truefalse
                        		high
                        mail.zqamcx.com
                        		unknown
                        		unknowntrueunknown

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        http://ip-api.com/line/?fields=hostingfalse
                          		high

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          http://www.apache.org/licenses/LICENSE-2.0Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.fontbureau.comQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.fontbureau.com/designersGQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://mail.zqamcx.comQuote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.fontbureau.com/designers/?Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.founder.com.cn/cn/bTheQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://account.dyn.com/Quote GVSE24-00815.exe, 00000000.00000002.1709737330.0000000003749000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                        		high
                                        http://r11.o.lencr.org0#Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137921930.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4143010272.00000000068D2000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.fontbureau.com/designers?Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://tempuri.org/ianiDataSet2.xsdMQuote GVSE24-00815.exefalse
                                              		high
                                              http://www.tiro.comQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.fontbureau.com/designersQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.goodfont.co.krQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.chiark.greenend.org.uk/~sgtatham/putty/0Quote GVSE24-00815.exefalse
                                                      		high
                                                      http://www.carterandcone.comlQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://tempuri.org/ianiDataSet.xsdQuote GVSE24-00815.exefalse
                                                          		high
                                                          http://www.sajatypeworks.comQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.typography.netDQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.fontbureau.com/designers/cabarga.htmlNQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.founder.com.cn/cn/cTheQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.galapagosdesign.com/staff/dennis.htmQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://tempuri.org/ianiDataSet1.xsdQuote GVSE24-00815.exefalse
                                                                      		high
                                                                      http://www.founder.com.cn/cnQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.fontbureau.com/designers/frere-user.htmlQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://x1.c.lencr.org/0Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137921930.0000000000FC7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://x1.i.lencr.org/0Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137921930.0000000000FC7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.jiyu-kobo.co.jp/Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://ip-api.comQuote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.galapagosdesign.com/DPleaseQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.fontbureau.com/designers8Quote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.fonts.comQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://www.sandoll.co.krQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://zqamcx.comQuote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.urwpp.deDPleaseQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.zhongyicts.com.cnQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameQuote GVSE24-00815.exe, 00000000.00000002.1707813519.000000000279A000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://www.sakkal.comQuote GVSE24-00815.exe, 00000000.00000002.1713652039.00000000068D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://r11.i.lencr.org/0#Quote GVSE24-00815.exe, 00000004.00000002.4139084542.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4137921930.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, Quote GVSE24-00815.exe, 00000004.00000002.4143010272.00000000068D2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high

                                                                                                      World Map of Contacted IPs

                                                                                                      • No. of IPs < 25%
                                                                                                      • 25% < No. of IPs < 50%
                                                                                                      • 50% < No. of IPs < 75%
                                                                                                      • 75% < No. of IPs

                                                                                                      Public IPs

                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                      208.95.112.1
                                                                                                      		ip-api.comUnited States
                                                                                                      		53334TUT-ASUSfalse
                                                                                                      78.110.166.82
                                                                                                      		zqamcx.comUnited Kingdom
                                                                                                      		42831UKSERVERS-ASUKDedicatedServersHostingandCo-Locationfalse

                                                                                                      General Information

                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                      Analysis ID:1561754
                                                                                                      Start date and time:2024-11-24 08:33:35 +01:00
                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                      Overall analysis duration:0h 8m 23s
                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                      Report type:full
                                                                                                      Cookbook file name:default.jbs
                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                      Number of analysed new started processes analysed:9
                                                                                                      Number of new started drivers analysed:0
                                                                                                      Number of existing processes analysed:0
                                                                                                      Number of existing drivers analysed:0
                                                                                                      Number of injected processes analysed:0
                                                                                                      Technologies:
                                                                                                      • HCA enabled
                                                                                                      • EGA enabled
                                                                                                      • AMSI enabled
                                                                                                      Analysis Mode:default
                                                                                                      Analysis stop reason:Timeout
                                                                                                      Sample name:Quote GVSE24-00815.exe
                                                                                                      Detection:MAL
                                                                                                      Classification:mal100.troj.spyw.evad.winEXE@6/6@3/2
                                                                                                      EGA Information:
                                                                                                      • Successful, ratio: 100%
                                                                                                      HCA Information:
                                                                                                      • Successful, ratio: 100%
                                                                                                      • Number of executed functions: 95
                                                                                                      • Number of non-executed functions: 17
                                                                                                      Cookbook Comments:
                                                                                                      • Found application associated with file extension: .exe
                                                                                                      • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                      Warnings

                                                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                      • Report size getting too big, too many NtCreateKey calls found.
                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                      • Report size getting too big, too many NtReadVirtualMemory calls found.

                                                                                                      Simulations

                                                                                                      Behavior and APIs

                                                                                                      TimeTypeDescription
                                                                                                      02:34:27API Interceptor10089331x Sleep call for process: Quote GVSE24-00815.exe modified
                                                                                                      02:34:29API Interceptor10x Sleep call for process: powershell.exe modified

                                                                                                      Joe Sandbox View / Context

                                                                                                      IPs

                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                      208.95.112.1EsgeCzT4do.exeGet hashmaliciousXWormBrowse
                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                      dLRcE11Dkl.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                      owuP726k3d.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                      WV7Gj9lJ7W.exeGet hashmaliciousXWormBrowse
                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                      18sFhgSyVK.exeGet hashmaliciousXWormBrowse
                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                      UH7iNNKgPW.exeGet hashmaliciousXWormBrowse
                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                      18fvs4AVae.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                      cmd.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                      • ip-api.com/json/?fields=225545
                                                                                                      z81zEuzkJPHHV3KYua.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                      Listing_error_15_code_file-002.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                                                                      • ip-api.com/json/
                                                                                                      78.110.166.82COB756883.vbsGet hashmaliciousCobaltStrikeBrowse
                                                                                                      • windowsupdatesolutions.com/ServerCOB.txt
                                                                                                      Ingreso_SII_Abril_2021.cmdGet hashmaliciousUnknownBrowse
                                                                                                      • www.emolcl.com/namaste/puma.php
                                                                                                      Ingreso_SII_Abril_2021.cmdGet hashmaliciousUnknownBrowse
                                                                                                      • www.emolcl.com/namaste/puma.php

                                                                                                      Domains

                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                      ip-api.comEsgeCzT4do.exeGet hashmaliciousXWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      dLRcE11Dkl.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      owuP726k3d.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      WV7Gj9lJ7W.exeGet hashmaliciousXWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      18sFhgSyVK.exeGet hashmaliciousXWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      UH7iNNKgPW.exeGet hashmaliciousXWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      18fvs4AVae.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      cmd.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                      • 208.95.112.1
                                                                                                      z81zEuzkJPHHV3KYua.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 208.95.112.1
                                                                                                      Listing_error_15_code_file-002.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                                                                      • 208.95.112.1
                                                                                                      zqamcx.comEKSTRE_1022.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      Musterino_94372478_Ekno_101_20241031410530_ekstre.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      Halkbank_Ekstre_20241118_081142_787116.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      PO NO170300999.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      Musterino_94372478_Ekno_101_20241031410530_ekstre.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      41570002689_20220814_05352297_HesapOzeti.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82

                                                                                                      ASNs

                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                      UKSERVERS-ASUKDedicatedServersHostingandCo-LocationEKSTRE_1022.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      New_Order_Inquiry.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      Musterino_94372478_Ekno_101_20241031410530_ekstre.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      Halkbank_Ekstre_20241118_081142_787116.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      (#U0130TOSAM) 11 KASIM 2024 HAFTALIK EKONOM#U0130 B#U00dcLTEN#U0130.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      PO NO170300999.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      sora.mips.elfGet hashmaliciousMiraiBrowse
                                                                                                      • 78.157.201.124
                                                                                                      RKsVnThLLP.exeGet hashmaliciousNjratBrowse
                                                                                                      • 94.46.207.10
                                                                                                      Musterino_94372478_Ekno_101_20241031410530_ekstre.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 78.110.166.82
                                                                                                      TUT-ASUSEsgeCzT4do.exeGet hashmaliciousXWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      dLRcE11Dkl.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      owuP726k3d.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      WV7Gj9lJ7W.exeGet hashmaliciousXWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      18sFhgSyVK.exeGet hashmaliciousXWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      UH7iNNKgPW.exeGet hashmaliciousXWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      18fvs4AVae.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                      • 208.95.112.1
                                                                                                      cmd.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                      • 208.95.112.1
                                                                                                      z81zEuzkJPHHV3KYua.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 208.95.112.1
                                                                                                      Listing_error_15_code_file-002.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                                                                      • 208.95.112.1

                                                                                                      JA3 Fingerprints

                                                                                                      ⊘No context

                                                                                                      Dropped Files

                                                                                                      ⊘No context

                                                                                                      Created / dropped Files

                                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quote GVSE24-00815.exe.log

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\Quote GVSE24-00815.exe
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1216
                                                                                                      Entropy (8bit):5.34331486778365
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                                      MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                                      SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                                      SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                                      SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                                      Malicious:true
                                                                                                      Reputation:high, very likely benign file
                                                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                      Download File
                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1172
                                                                                                      Entropy (8bit):5.357042452875322
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:3CytZWSKco4KmZjKbm51s4RPT6moUebIKo+mZ9t7J0gt/NKIl9r+q:yyjWSU4xymI4RfoUeW+mZ9tK8ND3
                                                                                                      MD5:827C68C8F65D2B0800E6791B34AB6D2E
                                                                                                      SHA1:151BC96F9C26C53E02D2E0DA64995A462D0C3B4E
                                                                                                      SHA-256:6B22A727792EC2ACE1BC27BF00BECBBD842902F2FD0FC813CF45A21A986377D5
                                                                                                      SHA-512:67E9E89C531B2CDF47FCBBA3F036EA66427631A8EBF287A26DD35AFB114AF6E2D945304CBF72B94358245FEED658F9BA6E19B29879AE6488D8DC7A143DCC146D
                                                                                                      Malicious:false
                                                                                                      Reputation:moderate, very likely benign file
                                                                                                      Preview:@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tivak4j.3p4.psm1

                                                                                                      Download File
                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):60
                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                      Malicious:false
                                                                                                      Reputation:high, very likely benign file
                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_itkhhyeh.24p.psm1

                                                                                                      Download File
                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):60
                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                      Malicious:false
                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pjnwwi5w.tds.ps1

                                                                                                      Download File
                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):60
                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                      Malicious:false
                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tjgib2nb.30d.ps1

                                                                                                      Download File
                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):60
                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                      Malicious:false
                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                      Static File Info

                                                                                                      General

                                                                                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                      Entropy (8bit):7.529677080166083
                                                                                                      TrID:
                                                                                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.98%
                                                                                                      • Win32 Executable (generic) a (10002005/4) 49.93%
                                                                                                      • Windows Screen Saver (13104/52) 0.07%
                                                                                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                      • DOS Executable Generic (2002/1) 0.01%
                                                                                                      File name:Quote GVSE24-00815.exe
                                                                                                      File size:997'896 bytes
                                                                                                      MD5:d04fe8d654f371aba620596e67963714
                                                                                                      SHA1:7e1ff1be9962bc31859cfc22757aad3df52ea193
                                                                                                      SHA256:9c9405332a044a5f3222dfc59bc8b36a4cd6fc4542c8651667aaf2101bb54ea8
                                                                                                      SHA512:55b371ad701384433bb31e81c466cfa1b623ecc4406b42e9d89c6151fafe5046dba07f422205c65f0bff16acfcf72e0edc23142f8b6e7b3f344294d1aefef1de
                                                                                                      SSDEEP:24576:kcOrkkzqRzxWItcgR/bq7lLWGkSS/lgp3A:ozqzWIb/eYGkTo3A
                                                                                                      TLSH:4825BF20B7F8DE67E27AB0B3DAC4525197B6D585767BE3AA0CC520CE25C27311383927
                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....>g..............0......(........... ........@.. .......................`............@................................

                                                                                                      File Icon

                                                                                                      Icon Hash:130b253d1931012d

                                                                                                      Static PE Info

                                                                                                      General

                                                                                                      Entrypoint:0x4ef8f6
                                                                                                      Entrypoint Section:.text
                                                                                                      Digitally signed:true
                                                                                                      Imagebase:0x400000
                                                                                                      Subsystem:windows gui
                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                      Time Stamp:0x673E9FC6 [Thu Nov 21 02:49:42 2024 UTC]
                                                                                                      TLS Callbacks:
                                                                                                      CLR (.Net) Version:
                                                                                                      OS Version Major:4
                                                                                                      OS Version Minor:0
                                                                                                      File Version Major:4
                                                                                                      File Version Minor:0
                                                                                                      Subsystem Version Major:4
                                                                                                      Subsystem Version Minor:0
                                                                                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                      Authenticode Signature

                                                                                                      Signature Valid:false
                                                                                                      Signature Issuer:CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
                                                                                                      Signature Validation Error:The digital signature of the object did not verify
                                                                                                      Error Number:-2146869232
                                                                                                      Not Before, Not After
                                                                                                      • 13/11/2018 00:00:00 08/11/2021 23:59:59
                                                                                                      Subject Chain
                                                                                                      • CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
                                                                                                      Version:3
                                                                                                      Thumbprint MD5:DABD77E44EF6B3BB91740FA46696B779
                                                                                                      Thumbprint SHA-1:5B9E273CF11941FD8C6BE3F038C4797BBE884268
                                                                                                      Thumbprint SHA-256:4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
                                                                                                      Serial:7C1118CBBADC95DA3752C46E47A27438

                                                                                                      Entrypoint Preview

                                                                                                      Instruction
                                                                                                      jmp dword ptr [00402000h]
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al
                                                                                                      add byte ptr [eax], al

                                                                                                      Data Directories

                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xef8a40x4f.text
                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xf00000x2588.rsrc
                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0xf04000x3608
                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xf40000xc.reloc
                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                      Sections

                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                      .text0x20000xed8fc0xeda00ece0d097a315e76139e38a21a50f1d30False0.7378661724092583data7.52645497703216IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                      .rsrc0xf00000x25880x260064f70c5eb885c5b46074f724d719b05aFalse0.8752055921052632data7.5770511535357725IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                      .reloc0xf40000xc0x200a41c1bf95df743e9190f43225866ae8aFalse0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                      Resources

                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                      RT_ICON0xf01000x2016PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9504504504504504
                                                                                                      RT_GROUP_ICON0xf21280x14data1.05
                                                                                                      RT_VERSION0xf214c0x23cdata0.46853146853146854
                                                                                                      RT_MANIFEST0xf23980x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                                      Imports

                                                                                                      DLLImport
                                                                                                      mscoree.dll_CorExeMain

                                                                                                      Network Behavior

                                                                                                      Network Port Distribution

                                                                                                      TCP Packets

                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                      Nov 24, 2024 08:34:31.182710886 CET4973580192.168.2.4208.95.112.1
                                                                                                      Nov 24, 2024 08:34:31.302329063 CET8049735208.95.112.1192.168.2.4
                                                                                                      Nov 24, 2024 08:34:31.303355932 CET4973580192.168.2.4208.95.112.1
                                                                                                      Nov 24, 2024 08:34:31.304111004 CET4973580192.168.2.4208.95.112.1
                                                                                                      Nov 24, 2024 08:34:31.423522949 CET8049735208.95.112.1192.168.2.4
                                                                                                      Nov 24, 2024 08:34:32.491986990 CET8049735208.95.112.1192.168.2.4
                                                                                                      Nov 24, 2024 08:34:32.546245098 CET4973580192.168.2.4208.95.112.1
                                                                                                      Nov 24, 2024 08:34:35.054538012 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:35.174132109 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:35.174204111 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:36.372843981 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:36.373070002 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:36.492554903 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:36.759104013 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:36.759303093 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:36.879179955 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:37.155103922 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:37.161700010 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:37.281774044 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:37.558909893 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:37.558993101 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:37.558999062 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:37.559129953 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:37.574136972 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:37.693718910 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:37.960000038 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:37.977615118 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:38.097184896 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:38.380646944 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:38.382509947 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:38.501974106 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:38.768135071 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:38.768474102 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:38.888035059 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:39.161525011 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:39.161856890 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:39.281496048 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:39.547892094 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:39.548135996 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:39.667659998 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:39.934016943 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:39.934236050 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:40.053894997 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:40.320183039 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:40.320936918 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:40.320936918 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:40.320936918 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:40.320974112 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:34:40.440556049 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:40.440582991 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:40.440593004 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:40.440606117 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:40.804949999 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:34:40.858860970 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:35:23.531078100 CET4973580192.168.2.4208.95.112.1
                                                                                                      Nov 24, 2024 08:35:23.650939941 CET8049735208.95.112.1192.168.2.4
                                                                                                      Nov 24, 2024 08:35:23.651063919 CET4973580192.168.2.4208.95.112.1
                                                                                                      Nov 24, 2024 08:36:13.546857119 CET49737587192.168.2.478.110.166.82
                                                                                                      Nov 24, 2024 08:36:13.667901039 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:36:13.934895039 CET5874973778.110.166.82192.168.2.4
                                                                                                      Nov 24, 2024 08:36:13.939970970 CET49737587192.168.2.478.110.166.82

                                                                                                      UDP Packets

                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                      Nov 24, 2024 08:34:31.032140017 CET5308553192.168.2.41.1.1.1
                                                                                                      Nov 24, 2024 08:34:31.169652939 CET53530851.1.1.1192.168.2.4
                                                                                                      Nov 24, 2024 08:34:33.528000116 CET5489653192.168.2.41.1.1.1
                                                                                                      Nov 24, 2024 08:34:34.515203953 CET5489653192.168.2.41.1.1.1
                                                                                                      Nov 24, 2024 08:34:35.053261995 CET53548961.1.1.1192.168.2.4
                                                                                                      Nov 24, 2024 08:34:35.053323030 CET53548961.1.1.1192.168.2.4

                                                                                                      DNS Queries

                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                      Nov 24, 2024 08:34:31.032140017 CET192.168.2.41.1.1.10xa253Standard query (0)ip-api.comA (IP address)IN (0x0001)false
                                                                                                      Nov 24, 2024 08:34:33.528000116 CET192.168.2.41.1.1.10x108Standard query (0)mail.zqamcx.comA (IP address)IN (0x0001)false
                                                                                                      Nov 24, 2024 08:34:34.515203953 CET192.168.2.41.1.1.10x108Standard query (0)mail.zqamcx.comA (IP address)IN (0x0001)false

                                                                                                      DNS Answers

                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                      Nov 24, 2024 08:34:31.169652939 CET1.1.1.1192.168.2.40xa253No error (0)ip-api.com208.95.112.1A (IP address)IN (0x0001)false
                                                                                                      Nov 24, 2024 08:34:35.053261995 CET1.1.1.1192.168.2.40x108No error (0)mail.zqamcx.comzqamcx.comCNAME (Canonical name)IN (0x0001)false
                                                                                                      Nov 24, 2024 08:34:35.053261995 CET1.1.1.1192.168.2.40x108No error (0)zqamcx.com78.110.166.82A (IP address)IN (0x0001)false
                                                                                                      Nov 24, 2024 08:34:35.053323030 CET1.1.1.1192.168.2.40x108No error (0)mail.zqamcx.comzqamcx.comCNAME (Canonical name)IN (0x0001)false
                                                                                                      Nov 24, 2024 08:34:35.053323030 CET1.1.1.1192.168.2.40x108No error (0)zqamcx.com78.110.166.82A (IP address)IN (0x0001)false

                                                                                                      HTTP Request Dependency Graph

                                                                                                      • ip-api.com

                                                                                                      HTTP Packets

                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                      0192.168.2.449735208.95.112.1803732C:\Users\user\Desktop\Quote GVSE24-00815.exe
                                                                                                      TimestampBytes transferredDirectionData
                                                                                                      Nov 24, 2024 08:34:31.304111004 CET80OUTGET /line/?fields=hosting HTTP/1.1
                                                                                                      Host: ip-api.com
                                                                                                      Connection: Keep-Alive
                                                                                                      Nov 24, 2024 08:34:32.491986990 CET175INHTTP/1.1 200 OK
                                                                                                      Date: Sun, 24 Nov 2024 07:34:31 GMT
                                                                                                      Content-Type: text/plain; charset=utf-8
                                                                                                      Content-Length: 6
                                                                                                      Access-Control-Allow-Origin: *
                                                                                                      X-Ttl: 60
                                                                                                      X-Rl: 44
                                                                                                      Data Raw: 66 61 6c 73 65 0a
                                                                                                      Data Ascii: false


                                                                                                      SMTP Packets

                                                                                                      TimestampSource PortDest PortSource IPDest IPCommands
                                                                                                      Nov 24, 2024 08:34:36.372843981 CET5874973778.110.166.82192.168.2.4220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Sun, 24 Nov 2024 07:34:36 +0000
                                                                                                      220-We do not authorize the use of this system to transport unsolicited,
                                                                                                      220 and/or bulk e-mail.
                                                                                                      Nov 24, 2024 08:34:36.373070002 CET49737587192.168.2.478.110.166.82EHLO 367706
                                                                                                      Nov 24, 2024 08:34:36.759104013 CET5874973778.110.166.82192.168.2.4250-cphost14.qhoster.net Hello 367706 [8.46.123.75]
                                                                                                      250-SIZE 52428800
                                                                                                      250-8BITMIME
                                                                                                      250-PIPELINING
                                                                                                      250-PIPECONNECT
                                                                                                      250-STARTTLS
                                                                                                      250 HELP
                                                                                                      Nov 24, 2024 08:34:36.759303093 CET49737587192.168.2.478.110.166.82STARTTLS
                                                                                                      Nov 24, 2024 08:34:37.155103922 CET5874973778.110.166.82192.168.2.4220 TLS go ahead

                                                                                                      Statistics

                                                                                                      CPU Usage

                                                                                                      Click to jump to process

                                                                                                      Memory Usage

                                                                                                      Click to jump to process

                                                                                                      High Level Behavior Distribution

                                                                                                      Click to dive into process behavior distribution

                                                                                                      Behavior

                                                                                                      Click to jump to process

                                                                                                      System Behavior

                                                                                                      General

                                                                                                      Target ID:0
                                                                                                      Start time:02:34:26
                                                                                                      Start date:24/11/2024
                                                                                                      Path:C:\Users\user\Desktop\Quote GVSE24-00815.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:"C:\Users\user\Desktop\Quote GVSE24-00815.exe"
                                                                                                      Imagebase:0x330000
                                                                                                      File size:997'896 bytes
                                                                                                      MD5 hash:D04FE8D654F371ABA620596E67963714
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1709737330.0000000003749000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1709737330.0000000003749000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      Reputation:low
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:2
                                                                                                      Start time:02:34:29
                                                                                                      Start date:24/11/2024
                                                                                                      Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe"
                                                                                                      Imagebase:0x240000
                                                                                                      File size:433'152 bytes
                                                                                                      MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:3
                                                                                                      Start time:02:34:29
                                                                                                      Start date:24/11/2024
                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                      File size:862'208 bytes
                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:4
                                                                                                      Start time:02:34:29
                                                                                                      Start date:24/11/2024
                                                                                                      Path:C:\Users\user\Desktop\Quote GVSE24-00815.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:"C:\Users\user\Desktop\Quote GVSE24-00815.exe"
                                                                                                      Imagebase:0xab0000
                                                                                                      File size:997'896 bytes
                                                                                                      MD5 hash:D04FE8D654F371ABA620596E67963714
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4139084542.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4139084542.0000000002EC2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4137696236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4139084542.0000000002E95000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4139084542.0000000002E95000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      Reputation:low
                                                                                                      Has exited:false

                                                                                                      Disassembly

                                                                                                      Reset < >

                                                                                                        Execution Graph

                                                                                                        Execution Coverage:10.7%
                                                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                                                        Signature Coverage:0%
                                                                                                        Total number of Nodes:213
                                                                                                        Total number of Limit Nodes:12
                                                                                                        execution_graph 32374 e3cfa0 32375 e3cfe6 32374->32375 32378 e3d588 32375->32378 32381 e3d1dc 32378->32381 32382 e3d5f0 DuplicateHandle 32381->32382 32383 e3d0d3 32382->32383 32592 e3ac10 32593 e3ac12 32592->32593 32597 e3acf9 32593->32597 32602 e3ad08 32593->32602 32594 e3ac1f 32599 e3ad08 32597->32599 32598 e3ad3c 32598->32594 32599->32598 32600 e3af40 GetModuleHandleW 32599->32600 32601 e3af6d 32600->32601 32601->32594 32604 e3ad0a 32602->32604 32603 e3ad3c 32603->32594 32604->32603 32605 e3af40 GetModuleHandleW 32604->32605 32606 e3af6d 32605->32606 32606->32594 32585 6e5a080 32586 6e5a20b 32585->32586 32587 6e5a0a6 32585->32587 32587->32586 32589 6e55fb0 32587->32589 32590 6e5a300 PostMessageW 32589->32590 32591 6e5a36c 32590->32591 32591->32587 32384 e34668 32385 e34672 32384->32385 32387 e34758 32384->32387 32388 e34768 32387->32388 32392 e34867 32388->32392 32396 e34868 32388->32396 32394 e3488f 32392->32394 32393 e3496c 32393->32393 32394->32393 32400 e344b4 32394->32400 32398 e3488f 32396->32398 32397 e3496c 32397->32397 32398->32397 32399 e344b4 CreateActCtxA 32398->32399 32399->32397 32401 e358f8 CreateActCtxA 32400->32401 32403 e359bb 32401->32403 32607 a0d01c 32609 a0d034 32607->32609 32608 a0d08e 32609->32608 32612 4ca2818 32609->32612 32617 4ca2817 32609->32617 32613 4ca2845 32612->32613 32614 4ca2877 32613->32614 32622 4ca299b 32613->32622 32627 4ca29a0 32613->32627 32618 4ca2845 32617->32618 32619 4ca2877 32618->32619 32620 4ca299b 2 API calls 32618->32620 32621 4ca29a0 2 API calls 32618->32621 32620->32619 32621->32619 32624 4ca29b4 32622->32624 32623 4ca2a40 32623->32614 32632 4ca2a58 32624->32632 32635 4ca2a53 32624->32635 32629 4ca29b4 32627->32629 32628 4ca2a40 32628->32614 32630 4ca2a58 2 API calls 32629->32630 32631 4ca2a53 2 API calls 32629->32631 32630->32628 32631->32628 32633 4ca2a69 32632->32633 32638 4ca401f 32632->32638 32633->32623 32636 4ca401f 2 API calls 32635->32636 32637 4ca2a69 32635->32637 32636->32637 32637->32623 32642 4ca403f 32638->32642 32646 4ca4040 32638->32646 32639 4ca402a 32639->32633 32643 4ca4082 32642->32643 32645 4ca4089 32642->32645 32644 4ca40da CallWindowProcW 32643->32644 32643->32645 32644->32645 32645->32639 32647 4ca4082 32646->32647 32649 4ca4089 32646->32649 32648 4ca40da CallWindowProcW 32647->32648 32647->32649 32648->32649 32649->32639 32404 6e581e8 32408 6e58f40 32404->32408 32426 6e58f22 32404->32426 32405 6e581f7 32409 6e58f5a 32408->32409 32444 6e59b15 32409->32444 32456 6e598ea 32409->32456 32461 6e593ee 32409->32461 32466 6e5946e 32409->32466 32476 6e594cd 32409->32476 32489 6e594c3 32409->32489 32494 6e59c3a 32409->32494 32499 6e59718 32409->32499 32504 6e5973e 32409->32504 32508 6e59a9f 32409->32508 32512 6e596d2 32409->32512 32517 6e59550 32409->32517 32522 6e59510 32409->32522 32527 6e59777 32409->32527 32532 6e59374 32409->32532 32410 6e58f7e 32410->32405 32427 6e58f5a 32426->32427 32429 6e594c3 2 API calls 32427->32429 32430 6e594cd 6 API calls 32427->32430 32431 6e5946e 4 API calls 32427->32431 32432 6e593ee 2 API calls 32427->32432 32433 6e598ea 2 API calls 32427->32433 32434 6e59b15 4 API calls 32427->32434 32435 6e59374 2 API calls 32427->32435 32436 6e59777 2 API calls 32427->32436 32437 6e59510 2 API calls 32427->32437 32438 6e59550 2 API calls 32427->32438 32439 6e596d2 2 API calls 32427->32439 32440 6e59a9f 2 API calls 32427->32440 32441 6e5973e 2 API calls 32427->32441 32442 6e59718 2 API calls 32427->32442 32443 6e59c3a 2 API calls 32427->32443 32428 6e58f7e 32428->32405 32429->32428 32430->32428 32431->32428 32432->32428 32433->32428 32434->32428 32435->32428 32436->32428 32437->32428 32438->32428 32439->32428 32440->32428 32441->32428 32442->32428 32443->32428 32545 6e57938 32444->32545 32549 6e57940 32444->32549 32445 6e59468 32445->32410 32446 6e59456 32446->32445 32447 6e59c51 32446->32447 32449 6e594c6 32446->32449 32454 6e57940 WriteProcessMemory 32447->32454 32455 6e57938 WriteProcessMemory 32447->32455 32448 6e59dac 32448->32410 32449->32410 32449->32448 32537 6e576f0 32449->32537 32541 6e576f8 32449->32541 32454->32445 32455->32445 32458 6e5950f 32456->32458 32457 6e59dac 32457->32410 32458->32457 32459 6e576f0 ResumeThread 32458->32459 32460 6e576f8 ResumeThread 32458->32460 32459->32458 32460->32458 32462 6e593f4 32461->32462 32553 6e57bc7 32462->32553 32557 6e57bc8 32462->32557 32468 6e59456 32466->32468 32471 6e594c6 32466->32471 32467 6e59468 32467->32410 32468->32467 32469 6e59c51 32468->32469 32468->32471 32472 6e57940 WriteProcessMemory 32469->32472 32473 6e57938 WriteProcessMemory 32469->32473 32470 6e59dac 32470->32410 32471->32410 32471->32470 32474 6e576f0 ResumeThread 32471->32474 32475 6e576f8 ResumeThread 32471->32475 32472->32467 32473->32467 32474->32471 32475->32471 32477 6e5996a 32476->32477 32478 6e59456 32476->32478 32561 6e577a1 32477->32561 32565 6e577a8 32477->32565 32479 6e59468 32478->32479 32480 6e59c51 32478->32480 32481 6e594c6 32478->32481 32479->32410 32483 6e57940 WriteProcessMemory 32480->32483 32484 6e57938 WriteProcessMemory 32480->32484 32481->32410 32482 6e59b0e 32481->32482 32485 6e576f0 ResumeThread 32481->32485 32486 6e576f8 ResumeThread 32481->32486 32482->32410 32483->32479 32484->32479 32485->32481 32486->32481 32490 6e594c6 32489->32490 32490->32410 32491 6e59dac 32490->32491 32492 6e576f0 ResumeThread 32490->32492 32493 6e576f8 ResumeThread 32490->32493 32491->32410 32492->32490 32493->32490 32495 6e59c40 32494->32495 32497 6e57940 WriteProcessMemory 32495->32497 32498 6e57938 WriteProcessMemory 32495->32498 32496 6e59c72 32496->32410 32497->32496 32498->32496 32500 6e59a11 32499->32500 32502 6e57940 WriteProcessMemory 32500->32502 32503 6e57938 WriteProcessMemory 32500->32503 32501 6e59a35 32502->32501 32503->32501 32506 6e577a1 Wow64SetThreadContext 32504->32506 32507 6e577a8 Wow64SetThreadContext 32504->32507 32505 6e59758 32505->32410 32506->32505 32507->32505 32569 6e57880 32508->32569 32573 6e57878 32508->32573 32509 6e59abd 32513 6e5950f 32512->32513 32514 6e59dac 32513->32514 32515 6e576f0 ResumeThread 32513->32515 32516 6e576f8 ResumeThread 32513->32516 32514->32410 32515->32513 32516->32513 32518 6e59556 32517->32518 32577 6e57a30 32518->32577 32581 6e57a28 32518->32581 32519 6e59579 32519->32410 32523 6e5950f 32522->32523 32523->32522 32524 6e59dac 32523->32524 32525 6e576f0 ResumeThread 32523->32525 32526 6e576f8 ResumeThread 32523->32526 32524->32410 32525->32523 32526->32523 32528 6e5950f 32527->32528 32529 6e59dac 32528->32529 32530 6e576f0 ResumeThread 32528->32530 32531 6e576f8 ResumeThread 32528->32531 32529->32410 32530->32528 32531->32528 32533 6e5937e 32532->32533 32534 6e5942b 32533->32534 32535 6e57bc7 CreateProcessA 32533->32535 32536 6e57bc8 CreateProcessA 32533->32536 32534->32410 32535->32534 32536->32534 32538 6e57738 ResumeThread 32537->32538 32540 6e57769 32538->32540 32540->32449 32542 6e57738 ResumeThread 32541->32542 32544 6e57769 32542->32544 32544->32449 32546 6e57988 WriteProcessMemory 32545->32546 32548 6e579df 32546->32548 32548->32446 32550 6e57988 WriteProcessMemory 32549->32550 32552 6e579df 32550->32552 32552->32446 32554 6e57c51 CreateProcessA 32553->32554 32556 6e57e13 32554->32556 32558 6e57c51 CreateProcessA 32557->32558 32560 6e57e13 32558->32560 32560->32560 32562 6e577a8 Wow64SetThreadContext 32561->32562 32564 6e57835 32562->32564 32564->32481 32566 6e577ed Wow64SetThreadContext 32565->32566 32568 6e57835 32566->32568 32568->32481 32570 6e578c0 VirtualAllocEx 32569->32570 32572 6e578fd 32570->32572 32572->32509 32574 6e57877 32573->32574 32574->32573 32575 6e578ca VirtualAllocEx 32574->32575 32576 6e578fd 32575->32576 32576->32509 32578 6e57a7b ReadProcessMemory 32577->32578 32580 6e57abf 32578->32580 32580->32519 32582 6e57a7b ReadProcessMemory 32581->32582 32584 6e57abf 32582->32584 32584->32519

                                                                                                        Executed Functions

                                                                                                        Function 04CA6BE0 Relevance: 13.2, Strings: 10, Instructions: 750COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712783779.0000000004CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CA0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4ca0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $ $&$&$7$O$O$s$}$}
                                                                                                        • API String ID: 0-911021792
                                                                                                        • Opcode ID: 5451fcd3d8ec84f0ab24cc086f21917acb52fa88a7af09722fb8b63e602f5e21
                                                                                                        • Instruction ID: 6491472bab4819fa91f2389f0de85f60d31ba75c313d04bdbf053e98ca65d2e6
                                                                                                        • Opcode Fuzzy Hash: 5451fcd3d8ec84f0ab24cc086f21917acb52fa88a7af09722fb8b63e602f5e21
                                                                                                        • Instruction Fuzzy Hash: 09628E30A10706CFD715EF78C844BAAB7B2FFC5304F1586A9D059AB360DB75A985CB81
                                                                                                        Function 04CA6BDA Relevance: 13.2, Strings: 10, Instructions: 674COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 490 4ca6bda-4ca6c15 494 4ca6c1f-4ca6c23 call 4ca68b0 490->494 496 4ca6c28-4ca6cbf call 4ca68b0 call 4ca68c0 call 4ca68d0 * 2 494->496 515 4ca6cc5-4ca6cf4 call 4ca68e0 496->515 517 4ca6cf9-4ca6d58 call 4ca68f0 515->517 521 4ca6d5d-4ca6d8c call 4ca6900 517->521 523 4ca6d91-4ca6dae call 4ca6910 521->523 526 4ca6db3 523->526 527 4ca6dbd-4ca6e3b call 4ca6920 call 4ca6930 526->527 537 4ca6e41-4ca6e52 527->537 538 4ca6ed6-4ca6ee5 527->538 539 4ca6e58-4ca6e6c 537->539 540 4ca764e 537->540 545 4ca6eeb-4ca6eef 538->545 539->540 541 4ca6e72-4ca6e7b 539->541 544 4ca7653-4ca7671 540->544 541->540 543 4ca6e81-4ca6e99 call 4ca6940 541->543 543->540 550 4ca6e9f-4ca6ed0 call 4ca6950 543->550 547 4ca767b-4ca773b call 4ca6a10 call 4ca6a20 544->547 681 4ca7676 call e38244 544->681 682 4ca7676 call e35ca4 544->682 683 4ca7676 call e38268 544->683 545->540 548 4ca6ef5-4ca6f08 545->548 548->540 555 4ca6f0e-4ca6fa0 548->555 550->537 550->538 577 4ca6faa-4ca6fb3 555->577 578 4ca6fbf-4ca7573 call 4ca68e0 call 4ca68f0 call 4ca6900 call 4ca6910 call 4ca68e0 call 4ca68f0 call 4ca6900 call 4ca6910 call 4ca6960 call 4ca6970 call 4ca68e0 call 4ca68f0 call 4ca6900 call 4ca6910 call 4ca6980 call 4ca68e0 call 4ca68f0 call 4ca6990 call 4ca6900 call 4ca6910 call 4ca6980 call 4ca69a0 call 4ca69b0 call 4ca69c0 call 4ca69d0 * 5 577->578 661 4ca758b-4ca764d call 4ca69e0 call 4ca69f0 call 4ca68f0 call 4ca5480 call 4ca6a00 578->661 662 4ca7575-4ca757b 578->662 663 4ca757f-4ca7581 662->663 664 4ca757d 662->664 663->661 664->661 681->547 682->547 683->547
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712783779.0000000004CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CA0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4ca0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $ $&$&$7$O$O$s$}$}
                                                                                                        • API String ID: 0-911021792
                                                                                                        • Opcode ID: 8ab046866466bd302757b39ff277d9a894abc84148f401f6e23c7e4d1e2badc0
                                                                                                        • Instruction ID: 23fec00bb06be44f83c511849da250a1fef2be8941fcdd590b64dc383e28e2fe
                                                                                                        • Opcode Fuzzy Hash: 8ab046866466bd302757b39ff277d9a894abc84148f401f6e23c7e4d1e2badc0
                                                                                                        • Instruction Fuzzy Hash: 81526E30A10B06CFD715EF78C844AAAB7B2FFC5304F1586A9D0596B360EB75B985CB81
                                                                                                        Function 06E5AF68 Relevance: .6, Instructions: 590COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 737a086ebb7c8a03c5a3ab92f68377ef65bc9da3dd70d13d092aff0f90dcbe38
                                                                                                        • Instruction ID: 27bd102dbc8e1a2fc1661285684df7503c3d44babc98bb173866503ffe059912
                                                                                                        • Opcode Fuzzy Hash: 737a086ebb7c8a03c5a3ab92f68377ef65bc9da3dd70d13d092aff0f90dcbe38
                                                                                                        • Instruction Fuzzy Hash: 3522CE30B013048FDB69DB69C564BAEBBF6AF89304F2544A9E546DB391CB34EC41CB51
                                                                                                        Function 06E57BC7 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 737 6e57bc7-6e57c5d 739 6e57c96-6e57cb6 737->739 740 6e57c5f-6e57c69 737->740 747 6e57cef-6e57d1e 739->747 748 6e57cb8-6e57cc2 739->748 740->739 741 6e57c6b-6e57c6d 740->741 742 6e57c90-6e57c93 741->742 743 6e57c6f-6e57c79 741->743 742->739 745 6e57c7d-6e57c8c 743->745 746 6e57c7b 743->746 745->745 749 6e57c8e 745->749 746->745 754 6e57d57-6e57e11 CreateProcessA 747->754 755 6e57d20-6e57d2a 747->755 748->747 750 6e57cc4-6e57cc6 748->750 749->742 752 6e57ce9-6e57cec 750->752 753 6e57cc8-6e57cd2 750->753 752->747 756 6e57cd4 753->756 757 6e57cd6-6e57ce5 753->757 768 6e57e13-6e57e19 754->768 769 6e57e1a-6e57ea0 754->769 755->754 758 6e57d2c-6e57d2e 755->758 756->757 757->757 759 6e57ce7 757->759 760 6e57d51-6e57d54 758->760 761 6e57d30-6e57d3a 758->761 759->752 760->754 763 6e57d3c 761->763 764 6e57d3e-6e57d4d 761->764 763->764 764->764 765 6e57d4f 764->765 765->760 768->769 779 6e57eb0-6e57eb4 769->779 780 6e57ea2-6e57ea6 769->780 782 6e57ec4-6e57ec8 779->782 783 6e57eb6-6e57eba 779->783 780->779 781 6e57ea8 780->781 781->779 785 6e57ed8-6e57edc 782->785 786 6e57eca-6e57ece 782->786 783->782 784 6e57ebc 783->784 784->782 788 6e57eee-6e57ef5 785->788 789 6e57ede-6e57ee4 785->789 786->785 787 6e57ed0 786->787 787->785 790 6e57ef7-6e57f06 788->790 791 6e57f0c 788->791 789->788 790->791 793 6e57f0d 791->793 793->793
                                                                                                        APIs
                                                                                                        • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06E57DFE
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateProcess
                                                                                                        • String ID:
                                                                                                        • API String ID: 963392458-0
                                                                                                        • Opcode ID: fd0fe8e7853d72a0edf10b44a75193d8612dce8782877b9222c4ee7a470d011d
                                                                                                        • Instruction ID: 85b6d707f24c9d328feea22e7e7c43ec983752be47b8c6eab6408ae4aac19e2a
                                                                                                        • Opcode Fuzzy Hash: fd0fe8e7853d72a0edf10b44a75193d8612dce8782877b9222c4ee7a470d011d
                                                                                                        • Instruction Fuzzy Hash: BF914871D003199FEF54CF68C841BEEBBB2BF48314F1585A9E808A7290DB749995CF91
                                                                                                        Function 06E57BC8 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 794 6e57bc8-6e57c5d 796 6e57c96-6e57cb6 794->796 797 6e57c5f-6e57c69 794->797 804 6e57cef-6e57d1e 796->804 805 6e57cb8-6e57cc2 796->805 797->796 798 6e57c6b-6e57c6d 797->798 799 6e57c90-6e57c93 798->799 800 6e57c6f-6e57c79 798->800 799->796 802 6e57c7d-6e57c8c 800->802 803 6e57c7b 800->803 802->802 806 6e57c8e 802->806 803->802 811 6e57d57-6e57e11 CreateProcessA 804->811 812 6e57d20-6e57d2a 804->812 805->804 807 6e57cc4-6e57cc6 805->807 806->799 809 6e57ce9-6e57cec 807->809 810 6e57cc8-6e57cd2 807->810 809->804 813 6e57cd4 810->813 814 6e57cd6-6e57ce5 810->814 825 6e57e13-6e57e19 811->825 826 6e57e1a-6e57ea0 811->826 812->811 815 6e57d2c-6e57d2e 812->815 813->814 814->814 816 6e57ce7 814->816 817 6e57d51-6e57d54 815->817 818 6e57d30-6e57d3a 815->818 816->809 817->811 820 6e57d3c 818->820 821 6e57d3e-6e57d4d 818->821 820->821 821->821 822 6e57d4f 821->822 822->817 825->826 836 6e57eb0-6e57eb4 826->836 837 6e57ea2-6e57ea6 826->837 839 6e57ec4-6e57ec8 836->839 840 6e57eb6-6e57eba 836->840 837->836 838 6e57ea8 837->838 838->836 842 6e57ed8-6e57edc 839->842 843 6e57eca-6e57ece 839->843 840->839 841 6e57ebc 840->841 841->839 845 6e57eee-6e57ef5 842->845 846 6e57ede-6e57ee4 842->846 843->842 844 6e57ed0 843->844 844->842 847 6e57ef7-6e57f06 845->847 848 6e57f0c 845->848 846->845 847->848 850 6e57f0d 848->850 850->850
                                                                                                        APIs
                                                                                                        • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06E57DFE
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateProcess
                                                                                                        • String ID:
                                                                                                        • API String ID: 963392458-0
                                                                                                        • Opcode ID: 10cff6996aeba0d30f23734298918b997c445a2a88e109ba7d4261b6ea362ca6
                                                                                                        • Instruction ID: 86edb9c85397a6697411ea8b45cffb258f47ea1361126308db6a157ba4c57eec
                                                                                                        • Opcode Fuzzy Hash: 10cff6996aeba0d30f23734298918b997c445a2a88e109ba7d4261b6ea362ca6
                                                                                                        • Instruction Fuzzy Hash: 76914771D003199FEF54CF68C841BEEBBB2BF48314F1585A9E808A7290DB749995CF92
                                                                                                        Function 00E3AD08 Relevance: 1.7, APIs: 1, Instructions: 194COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 851 e3ad08-e3ad17 853 e3ad43-e3ad47 851->853 854 e3ad19-e3ad26 call e3a02c 851->854 855 e3ad5b-e3ad9c 853->855 856 e3ad49-e3ad53 853->856 861 e3ad28 854->861 862 e3ad3c 854->862 863 e3ada9-e3adb7 855->863 864 e3ad9e-e3ada6 855->864 856->855 907 e3ad2e call e3afa0 861->907 908 e3ad2e call e3af9b 861->908 862->853 866 e3addb-e3addd 863->866 867 e3adb9-e3adbe 863->867 864->863 865 e3ad34-e3ad36 865->862 868 e3ae78-e3af38 865->868 869 e3ade0-e3ade7 866->869 870 e3adc0-e3adc7 call e3a038 867->870 871 e3adc9 867->871 902 e3af40-e3af6b GetModuleHandleW 868->902 903 e3af3a-e3af3d 868->903 872 e3adf4-e3adfb 869->872 873 e3ade9-e3adf1 869->873 874 e3adcb-e3add9 870->874 871->874 877 e3ae08-e3ae11 call e3a048 872->877 878 e3adfd-e3ae05 872->878 873->872 874->869 883 e3ae13-e3ae1b 877->883 884 e3ae1e-e3ae23 877->884 878->877 883->884 886 e3ae41-e3ae45 884->886 887 e3ae25-e3ae2c 884->887 909 e3ae48 call e3b2a0 886->909 910 e3ae48 call e3b270 886->910 887->886 888 e3ae2e-e3ae3e call e3a058 call e3a068 887->888 888->886 889 e3ae4b-e3ae4e 892 e3ae71-e3ae77 889->892 893 e3ae50-e3ae6e 889->893 893->892 904 e3af74-e3af88 902->904 905 e3af6d-e3af73 902->905 903->902 905->904 907->865 908->865 909->889 910->889
                                                                                                        APIs
                                                                                                        • GetModuleHandleW.KERNELBASE(00000000), ref: 00E3AF5E
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1707578148.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_e30000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: HandleModule
                                                                                                        • String ID:
                                                                                                        • API String ID: 4139908857-0
                                                                                                        • Opcode ID: 26087e7de488cca1490a3edc69d5a1ee35643a5176f7c62137a55c01e49b9fd3
                                                                                                        • Instruction ID: 8ed931fc95b20f97e8b1887750944d1f8cca550cd7fdcfc8498aacb4721bbbe6
                                                                                                        • Opcode Fuzzy Hash: 26087e7de488cca1490a3edc69d5a1ee35643a5176f7c62137a55c01e49b9fd3
                                                                                                        • Instruction Fuzzy Hash: E8711670A00B058FD764DF2AD04575ABBF1FF88308F148A2DD486E7A50D775E989CB91
                                                                                                        Function 00E344B4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1019 e344b4-e359b9 CreateActCtxA 1022 e359c2-e35a1c 1019->1022 1023 e359bb-e359c1 1019->1023 1030 e35a2b-e35a2f 1022->1030 1031 e35a1e-e35a21 1022->1031 1023->1022 1032 e35a31-e35a3d 1030->1032 1033 e35a40 1030->1033 1031->1030 1032->1033 1035 e35a41 1033->1035 1035->1035
                                                                                                        APIs
                                                                                                        • CreateActCtxA.KERNEL32(?), ref: 00E359A9
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1707578148.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_e30000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Create
                                                                                                        • String ID:
                                                                                                        • API String ID: 2289755597-0
                                                                                                        • Opcode ID: b1f38da9b23e47f08c615ccd349f1f80768eaaf738b65188ccb79ea885540aab
                                                                                                        • Instruction ID: 40457e3d6b2fdc085d8dcca68a91e9274c0dcd343d0a0fd4ccf9bb9fc70e32c7
                                                                                                        • Opcode Fuzzy Hash: b1f38da9b23e47f08c615ccd349f1f80768eaaf738b65188ccb79ea885540aab
                                                                                                        • Instruction Fuzzy Hash: 4441D0B1D0071DCBDB24DFA9C988B9EBBB5BF48304F20816AD408BB255DBB56945CF90
                                                                                                        Function 04CA4040 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1052 4ca4040-4ca407c 1053 4ca412c-4ca414c 1052->1053 1054 4ca4082-4ca4087 1052->1054 1061 4ca414f-4ca415c 1053->1061 1055 4ca40da-4ca4112 CallWindowProcW 1054->1055 1056 4ca4089-4ca40c0 1054->1056 1057 4ca411b-4ca412a 1055->1057 1058 4ca4114-4ca411a 1055->1058 1062 4ca40c9-4ca40d8 1056->1062 1063 4ca40c2-4ca40c8 1056->1063 1057->1061 1058->1057 1062->1061 1063->1062
                                                                                                        APIs
                                                                                                        • CallWindowProcW.USER32(?,?,?,?,?), ref: 04CA4101
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712783779.0000000004CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CA0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4ca0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CallProcWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 2714655100-0
                                                                                                        • Opcode ID: 7adc5a5313313426b431e33ef74ec3475580f6c80b1aec8d787709c8a5e40a91
                                                                                                        • Instruction ID: 73f2e6047c231268b651199611b0e21503fd41958302e31db409a18cf3c487e2
                                                                                                        • Opcode Fuzzy Hash: 7adc5a5313313426b431e33ef74ec3475580f6c80b1aec8d787709c8a5e40a91
                                                                                                        • Instruction Fuzzy Hash: 05413BB8900219DFDB14CF99C448AABBBF5FB88314F14C459D519A7321D375A841CFA4
                                                                                                        Function 00E358F7 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1036 e358f7-e359b9 CreateActCtxA 1038 e359c2-e35a1c 1036->1038 1039 e359bb-e359c1 1036->1039 1046 e35a2b-e35a2f 1038->1046 1047 e35a1e-e35a21 1038->1047 1039->1038 1048 e35a31-e35a3d 1046->1048 1049 e35a40 1046->1049 1047->1046 1048->1049 1051 e35a41 1049->1051 1051->1051
                                                                                                        APIs
                                                                                                        • CreateActCtxA.KERNEL32(?), ref: 00E359A9
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1707578148.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_e30000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Create
                                                                                                        • String ID:
                                                                                                        • API String ID: 2289755597-0
                                                                                                        • Opcode ID: 429f0ab441469eda841f63f4f474d9343a9980ce8b6292b220d3993c608b7f90
                                                                                                        • Instruction ID: 4a7891529880d3f1e8f841141d15a6cf16e79ff37972c69cf0dbb2335d1a59a4
                                                                                                        • Opcode Fuzzy Hash: 429f0ab441469eda841f63f4f474d9343a9980ce8b6292b220d3993c608b7f90
                                                                                                        • Instruction Fuzzy Hash: AF41D1B1C00619CBDB24DFA9C9887CDBBB5BF48304F20816AD408BB255DB756946CF90
                                                                                                        Function 06E57940 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1066 6e57940-6e5798e 1068 6e57990-6e5799c 1066->1068 1069 6e5799e-6e579dd WriteProcessMemory 1066->1069 1068->1069 1071 6e579e6-6e57a16 1069->1071 1072 6e579df-6e579e5 1069->1072 1072->1071
                                                                                                        APIs
                                                                                                        • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06E579D0
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MemoryProcessWrite
                                                                                                        • String ID:
                                                                                                        • API String ID: 3559483778-0
                                                                                                        • Opcode ID: 3801607ac283c1ad186e521fca223d0b519eb365f15c8533446e147d2b9a6001
                                                                                                        • Instruction ID: 216a9e53922b3d0ff3a464574e1c5aa5157bbf2946f6bbafe77dd9dc2936d12b
                                                                                                        • Opcode Fuzzy Hash: 3801607ac283c1ad186e521fca223d0b519eb365f15c8533446e147d2b9a6001
                                                                                                        • Instruction Fuzzy Hash: 352124B19003599FDF10DFA9C885BDEBBF5FF48314F10842AE958A7250C7789954CBA4
                                                                                                        Function 06E57938 Relevance: 1.6, APIs: 1, Instructions: 67injectionCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1076 6e57938-6e5798e 1078 6e57990-6e5799c 1076->1078 1079 6e5799e-6e579dd WriteProcessMemory 1076->1079 1078->1079 1081 6e579e6-6e57a16 1079->1081 1082 6e579df-6e579e5 1079->1082 1082->1081
                                                                                                        APIs
                                                                                                        • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06E579D0
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MemoryProcessWrite
                                                                                                        • String ID:
                                                                                                        • API String ID: 3559483778-0
                                                                                                        • Opcode ID: 09996550ad190d7973f58ea6dbfad90f3f29c95a6048f4b4fe2fa0541f6150fb
                                                                                                        • Instruction ID: 3b037f6c7b8fc216f11dc0b029546de32dcd9526e7b0b1139d0e3d6eb864d0b3
                                                                                                        • Opcode Fuzzy Hash: 09996550ad190d7973f58ea6dbfad90f3f29c95a6048f4b4fe2fa0541f6150fb
                                                                                                        • Instruction Fuzzy Hash: 362144B2900309CFDB14CFA9C981BDEBBF1FF48314F10882AE959A7250C7789954CB64
                                                                                                        Function 06E577A1 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1086 6e577a1-6e577f3 1089 6e577f5-6e57801 1086->1089 1090 6e57803-6e57833 Wow64SetThreadContext 1086->1090 1089->1090 1092 6e57835-6e5783b 1090->1092 1093 6e5783c-6e5786c 1090->1093 1092->1093
                                                                                                        APIs
                                                                                                        • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06E57826
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ContextThreadWow64
                                                                                                        • String ID:
                                                                                                        • API String ID: 983334009-0
                                                                                                        • Opcode ID: 777ddf0747e6a419e238d0952c68cb568b3f83d6b096453177e6d6ac84c9dc43
                                                                                                        • Instruction ID: d8e009e7db5739daec689b5d4822bc2d0c18d4ea85c8262ac627807e438e5c72
                                                                                                        • Opcode Fuzzy Hash: 777ddf0747e6a419e238d0952c68cb568b3f83d6b096453177e6d6ac84c9dc43
                                                                                                        • Instruction Fuzzy Hash: 2B216A71D003089FDB14DFAAC8857EEBBF4EF48324F108429D859A7240C7789944CFA5
                                                                                                        Function 00E3D1DC Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00E3D5B6,?,?,?,?,?), ref: 00E3D677
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1707578148.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_e30000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DuplicateHandle
                                                                                                        • String ID:
                                                                                                        • API String ID: 3793708945-0
                                                                                                        • Opcode ID: 199c3c754781724062155300a93384ff99333d2cc67bcb20f46dedde3c191886
                                                                                                        • Instruction ID: adb977aedbd1ff225029dcb35a095d226fc2382dcf17100673ccd9169efef24b
                                                                                                        • Opcode Fuzzy Hash: 199c3c754781724062155300a93384ff99333d2cc67bcb20f46dedde3c191886
                                                                                                        • Instruction Fuzzy Hash: D721E5B5900258EFDB10CFAAD984ADEBFF4EB48314F14841AE918B7310D375A950CFA4
                                                                                                        Function 06E577A8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06E57826
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ContextThreadWow64
                                                                                                        • String ID:
                                                                                                        • API String ID: 983334009-0
                                                                                                        • Opcode ID: ef38e2226f995e38c242c3eef698c903774e89ae5572150118ba71a5e678b9cf
                                                                                                        • Instruction ID: 6dfa32544258c49e6c7dcb2eec768cf0998f4b415a2711c81cd929e577097f7b
                                                                                                        • Opcode Fuzzy Hash: ef38e2226f995e38c242c3eef698c903774e89ae5572150118ba71a5e678b9cf
                                                                                                        • Instruction Fuzzy Hash: 782149B1D003198FDB10DFAAC4857EEBBF4EF88324F108429D859A7241C7789944CFA5
                                                                                                        Function 06E57A30 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06E57AB0
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MemoryProcessRead
                                                                                                        • String ID:
                                                                                                        • API String ID: 1726664587-0
                                                                                                        • Opcode ID: 40b371e42a90c7812d2e3841ff2cee75372264c767dc3ebefa532a7f36036226
                                                                                                        • Instruction ID: 364752d7e0993e058fd0826e1ba8c0dac3aaa0fa1acfdd770bf7c579281eba11
                                                                                                        • Opcode Fuzzy Hash: 40b371e42a90c7812d2e3841ff2cee75372264c767dc3ebefa532a7f36036226
                                                                                                        • Instruction Fuzzy Hash: 7B2128B1C003599FCB10DFAAC885ADEFBF5FF48310F10842AE958A7250D7389954CBA4
                                                                                                        Function 06E57A28 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06E57AB0
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MemoryProcessRead
                                                                                                        • String ID:
                                                                                                        • API String ID: 1726664587-0
                                                                                                        • Opcode ID: 0ab3fb81a63e3fbc927090df84698755a99848580a9d1865af73fae6e776a6aa
                                                                                                        • Instruction ID: 1099e9d0b3acaf13e32c76042b8225194d5e1690d149472af7022d4b508e7afb
                                                                                                        • Opcode Fuzzy Hash: 0ab3fb81a63e3fbc927090df84698755a99848580a9d1865af73fae6e776a6aa
                                                                                                        • Instruction Fuzzy Hash: 902114B1D00349DFDB14CFA9C981ADEBBF1FF48310F10882AE558A7250DB399951DBA4
                                                                                                        Function 06E57878 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06E578EE
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AllocVirtual
                                                                                                        • String ID:
                                                                                                        • API String ID: 4275171209-0
                                                                                                        • Opcode ID: 7846323521c70aee3b923136851ecfa0a44251cd7168d1792abc9e0ec6cf9010
                                                                                                        • Instruction ID: 9c88b1710ac509e58af956a8ca982e9e76bd26231e29f21aec4784bd82e0899a
                                                                                                        • Opcode Fuzzy Hash: 7846323521c70aee3b923136851ecfa0a44251cd7168d1792abc9e0ec6cf9010
                                                                                                        • Instruction Fuzzy Hash: 541164B1900348CFCF14CFA9C9417EEBBF1AF88324F14881AD959A7260C77A9954CFA1
                                                                                                        Function 06E57880 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06E578EE
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AllocVirtual
                                                                                                        • String ID:
                                                                                                        • API String ID: 4275171209-0
                                                                                                        • Opcode ID: 2288692ad780eee20529f6459d7e827e4ade19086ebb57524bdda8fe3ab8a4e3
                                                                                                        • Instruction ID: 483b4635633cd011c2bf08053cb3b1e7fc2c0d6831df98e85e0f93fb204ab03d
                                                                                                        • Opcode Fuzzy Hash: 2288692ad780eee20529f6459d7e827e4ade19086ebb57524bdda8fe3ab8a4e3
                                                                                                        • Instruction Fuzzy Hash: 6B1156B19002489FCB10DFAAC844ADEBBF5EF88324F108419E919A7250C735A950CFA4
                                                                                                        Function 06E576F8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ResumeThread
                                                                                                        • String ID:
                                                                                                        • API String ID: 947044025-0
                                                                                                        • Opcode ID: 36c53816ad6e27930202e4e3e91992188ca2546e7a1bd4c07cf18faede107a87
                                                                                                        • Instruction ID: 34174176b0b1a111c176b90244a68ba1c74f4699d26a914469b33a329124117f
                                                                                                        • Opcode Fuzzy Hash: 36c53816ad6e27930202e4e3e91992188ca2546e7a1bd4c07cf18faede107a87
                                                                                                        • Instruction Fuzzy Hash: 871128B19003498BDB14DFAAD4457DEFBF4EB88324F208419D559A7250C775A944CB94
                                                                                                        Function 00E3AEF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GetModuleHandleW.KERNELBASE(00000000), ref: 00E3AF5E
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1707578148.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_e30000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: HandleModule
                                                                                                        • String ID:
                                                                                                        • API String ID: 4139908857-0
                                                                                                        • Opcode ID: 88bcfa0f964fa1e85af107dd90bd95a796da198e2517eddcbe6266cfe354a531
                                                                                                        • Instruction ID: badb69d41170ee2fd7dc856eb5e22f6a0c111b7b290518ba9770090721e23328
                                                                                                        • Opcode Fuzzy Hash: 88bcfa0f964fa1e85af107dd90bd95a796da198e2517eddcbe6266cfe354a531
                                                                                                        • Instruction Fuzzy Hash: 70110FB5D002498FCB10CF9AC448ADEFBF4AB88324F14842AD458B7210C379A585CFA5
                                                                                                        Function 06E576F0 Relevance: 1.5, APIs: 1, Instructions: 47threadCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ResumeThread
                                                                                                        • String ID:
                                                                                                        • API String ID: 947044025-0
                                                                                                        • Opcode ID: e33854b495e2ff704141d738f80fde38a359fb1680857bf19bcdc3dbdcb4ed40
                                                                                                        • Instruction ID: 5c5f61a10b4d0c14bb17c57964fed78bbe096092750ff719befcd709a5010c61
                                                                                                        • Opcode Fuzzy Hash: e33854b495e2ff704141d738f80fde38a359fb1680857bf19bcdc3dbdcb4ed40
                                                                                                        • Instruction Fuzzy Hash: F81143B59003498BCB14CFA9C5453DEBBF5AB88324F20882AC559A7250CB79A944CB94
                                                                                                        Function 06E55FB0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • PostMessageW.USER32(?,00000010,00000000,?), ref: 06E5A35D
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessagePost
                                                                                                        • String ID:
                                                                                                        • API String ID: 410705778-0
                                                                                                        • Opcode ID: c5d1a424d1412cb207830c85a318c9bc8f43081ff8e390b87c3d61f0baf32475
                                                                                                        • Instruction ID: f2cc85309fdb6ad0f8177b2bb3263068be2f24ab2304bd966767f13f190320d6
                                                                                                        • Opcode Fuzzy Hash: c5d1a424d1412cb207830c85a318c9bc8f43081ff8e390b87c3d61f0baf32475
                                                                                                        • Instruction Fuzzy Hash: C11103B5800348DFDB10DF9AD989BDEBBF8EB48324F10845AE958A7210D375A944CFA5
                                                                                                        Function 06E5A2F8 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • PostMessageW.USER32(?,00000010,00000000,?), ref: 06E5A35D
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessagePost
                                                                                                        • String ID:
                                                                                                        • API String ID: 410705778-0
                                                                                                        • Opcode ID: 7cc36fdac2f94474b03c0e6c8c7ef784d0a981a05e083087ef650eed78ccfa6b
                                                                                                        • Instruction ID: b3280fc29b2ecd421015e82811ff3d8ed9e85b4fc47cddb1ca07325137cd9241
                                                                                                        • Opcode Fuzzy Hash: 7cc36fdac2f94474b03c0e6c8c7ef784d0a981a05e083087ef650eed78ccfa6b
                                                                                                        • Instruction Fuzzy Hash: 5C1115B5800349CFDB14CF99D589BDEBBF5FB48314F20841AD968A7210C375A940CFA4
                                                                                                        Function 009FD3D8 Relevance: .1, Instructions: 75COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1706644317.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_9fd000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 0193a96f388592173f2ec0ef304f894ae0fef7fb7817df19612330579cfff041
                                                                                                        • Instruction ID: 34205300065a2a1a1ae4acb017c5f719685a29f154f39ba631459ad80dc0d3ee
                                                                                                        • Opcode Fuzzy Hash: 0193a96f388592173f2ec0ef304f894ae0fef7fb7817df19612330579cfff041
                                                                                                        • Instruction Fuzzy Hash: 5F213A71501208DFDB05DF14D9C4B36BF6AFB94324F20C569DA094B2A6C33AE856C7A2
                                                                                                        Function 00A0D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1706729767.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_a0d000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: d9c8c6868854d2339d7aff8238870083d4115294cdd5bafc629f0e7fcc1747b3
                                                                                                        • Instruction ID: 7b796d719e07c6246e563e06aee805409ed654d0a0b7319fb3b7afefe82fe8ae
                                                                                                        • Opcode Fuzzy Hash: d9c8c6868854d2339d7aff8238870083d4115294cdd5bafc629f0e7fcc1747b3
                                                                                                        • Instruction Fuzzy Hash: FC210472504208EFDB05DF94E9C0B66BBA5FB88314F20C66DE8094B296C336D846CA61
                                                                                                        Function 00A0D01C Relevance: .1, Instructions: 72COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1706729767.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_a0d000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 7c2e9a249b27cce4d63a1f4464fd6e7168a81799ef62bdec5fef08a233c6ea78
                                                                                                        • Instruction ID: 93fb4f283dee840b337c50c4c9e690e6bf98c8133b405ce3d71f31c8c6a0c37f
                                                                                                        • Opcode Fuzzy Hash: 7c2e9a249b27cce4d63a1f4464fd6e7168a81799ef62bdec5fef08a233c6ea78
                                                                                                        • Instruction Fuzzy Hash: B821F272604208EFDB14DF54E984B26BFA5FB84314F20C569D84E4B296C33AD847CA61
                                                                                                        Function 00A0D006 Relevance: .1, Instructions: 60COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1706729767.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_a0d000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 3772ca5fa30dbdf16049056414a17902eaabe77c7a20551a5a4e11924bf25be2
                                                                                                        • Instruction ID: c63003ccbc24b95458d0cfdfee208dd74ad38dfd1a95a87433ecc9020c0e3792
                                                                                                        • Opcode Fuzzy Hash: 3772ca5fa30dbdf16049056414a17902eaabe77c7a20551a5a4e11924bf25be2
                                                                                                        • Instruction Fuzzy Hash: 9621A1765093848FCB02CF24D994715BF71EB46314F28C5DAD8498B6A7C33A980ACB62
                                                                                                        Function 009FD3D3 Relevance: .1, Instructions: 56COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1706644317.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_9fd000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                                        • Instruction ID: b38dbc54f26123447e69e2737cb0b4992cb26f232b7b02fe039b4f56c4bfe843
                                                                                                        • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                                        • Instruction Fuzzy Hash: 9E112672404244CFDB02CF00D5C4B26BF72FB94324F24C2A9DD090B666C33AE85ACBA2
                                                                                                        Function 00A0D1CF Relevance: .1, Instructions: 53COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1706729767.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_a0d000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                                        • Instruction ID: b6471e28803d09f6feb110c8383b47adc558274b7172f30b7fc6226815146d53
                                                                                                        • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                                        • Instruction Fuzzy Hash: F011BB76504284DFCB02CF54D5C4B55BBA1FB88314F24C6AAD8494B696C33AD80ACB61
                                                                                                        Function 009FD759 Relevance: .0, Instructions: 45COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1706644317.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_9fd000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 3f4b54ec43438eb4f22beb1910798a56348b4409e5d0a63adcc8a88234627361
                                                                                                        • Instruction ID: 4bf7ad468f2fc4b8b8534f21a31a4f34f915c706706287c57f3a8453bed3b319
                                                                                                        • Opcode Fuzzy Hash: 3f4b54ec43438eb4f22beb1910798a56348b4409e5d0a63adcc8a88234627361
                                                                                                        • Instruction Fuzzy Hash: BE01A7B110A3489AE7106A25CDC4777FFDDEF51324F18C92AEE194E29AC2799840C771
                                                                                                        Function 009FD758 Relevance: .0, Instructions: 36COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1706644317.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_9fd000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 3b4ff75bbadd6b9704945baaa9cf1feeab71acfd5cb29d21a4d785abafdb6835
                                                                                                        • Instruction ID: 3ae01bf7a502176649a9bbabbe575eb8690a797c8bd9bb481655b178ad2e61cc
                                                                                                        • Opcode Fuzzy Hash: 3b4ff75bbadd6b9704945baaa9cf1feeab71acfd5cb29d21a4d785abafdb6835
                                                                                                        • Instruction Fuzzy Hash: 51F06271405344AEE7109A16DCC4B62FFACEF51724F18C45AEE084F29AC2799844CBB1

                                                                                                        Non-executed Functions

                                                                                                        Function 04CA6BD1 Relevance: 5.4, Strings: 4, Instructions: 359COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712783779.0000000004CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CA0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4ca0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: &$&$7$O
                                                                                                        • API String ID: 0-4198643847
                                                                                                        • Opcode ID: 7648d9f9235295c6a4e484dc463b1ee4d409dd1a146df960bb34704c2e0291c9
                                                                                                        • Instruction ID: cd884e05aa307374cb13d53f64ac66387d5714055e046400a42cb1b23ce891f9
                                                                                                        • Opcode Fuzzy Hash: 7648d9f9235295c6a4e484dc463b1ee4d409dd1a146df960bb34704c2e0291c9
                                                                                                        • Instruction Fuzzy Hash: 2AF14C30A10B06CFD715EF74C854A9AB3B2BFC6308F258699D0596B360EB71B995CB81
                                                                                                        Function 06E56ED0 Relevance: 1.6, Strings: 1, Instructions: 312COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: -Eg0
                                                                                                        • API String ID: 0-153627160
                                                                                                        • Opcode ID: 3a2c92e7355131767dd1b65c5d67dc85e98e382d244574621c2372351248dba7
                                                                                                        • Instruction ID: e0711625c20f2cedf46ac525fbd8bb70021bee12dbd5c200b2e3b51d480558bf
                                                                                                        • Opcode Fuzzy Hash: 3a2c92e7355131767dd1b65c5d67dc85e98e382d244574621c2372351248dba7
                                                                                                        • Instruction Fuzzy Hash: CCE11B74E102198FCB14DFA9C5809AEFBF2BF89305F25D15AE814AB356DB31A941CF60
                                                                                                        Function 04CA0040 Relevance: .3, Instructions: 315COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712783779.0000000004CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CA0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4ca0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: e61e9f7f6e98349b81691884068b6bbe9e13d3c7625020bcd65502b908978320
                                                                                                        • Instruction ID: 69c18ca168b56f295fab4a108a33378180cec9bff64781cfdf4fa7f4739e7d79
                                                                                                        • Opcode Fuzzy Hash: e61e9f7f6e98349b81691884068b6bbe9e13d3c7625020bcd65502b908978320
                                                                                                        • Instruction Fuzzy Hash: 691297B0C917468AD318CF6EE98D1897BB1BFC5318BD0CA09D2A52B6E1D7B4116ACF44
                                                                                                        Function 06E54FB8 Relevance: .3, Instructions: 312COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 4fc7a98fe3c11e88aee71bd7ffa8974e5786647358c313f893e0ddce59072b76
                                                                                                        • Instruction ID: e53159e268875be5b57cce009469c5d3f7667d3af66b3d72e6f9efc071a24a96
                                                                                                        • Opcode Fuzzy Hash: 4fc7a98fe3c11e88aee71bd7ffa8974e5786647358c313f893e0ddce59072b76
                                                                                                        • Instruction Fuzzy Hash: 2CE10B74E102598FCB14DFA9C5809AEFBF2BF89305F25D169D814AB356DB30A941CFA0
                                                                                                        Function 06E56A98 Relevance: .3, Instructions: 312COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 9aae536f520305684b23e1ce3b4a67886df3ffce7e55d926792f0cbc05d2ce19
                                                                                                        • Instruction ID: d3c414909caae2a64d7ba2996dcfc5d17d1bd813c01bff9a0f05f7960c2f5da4
                                                                                                        • Opcode Fuzzy Hash: 9aae536f520305684b23e1ce3b4a67886df3ffce7e55d926792f0cbc05d2ce19
                                                                                                        • Instruction Fuzzy Hash: 01E1F974E002598FCB54DFA9C5809AEBBF2FF89305F25D159E814AB356DB30A941CFA0
                                                                                                        Function 06E553F0 Relevance: .3, Instructions: 312COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 6d5a56939d301e722648a5ea1da4c5ef81e21f651b71697ea51cef1f8e3e92f1
                                                                                                        • Instruction ID: dd7dd0db1329cbae2303bcb193a2b4e923ea9e2a9799fb3ae01889d34c2b5f62
                                                                                                        • Opcode Fuzzy Hash: 6d5a56939d301e722648a5ea1da4c5ef81e21f651b71697ea51cef1f8e3e92f1
                                                                                                        • Instruction Fuzzy Hash: 18E11874E102598FCB14DFA9C5809AEFBF2BF88305F25D169E815AB356DB30A941CF60
                                                                                                        Function 06E54B80 Relevance: .3, Instructions: 312COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: dab7edca806801eda65346c29c610c66d8dfa477f834f9ce5f7a362220d47429
                                                                                                        • Instruction ID: 71371462827a9c7207386931be1b35a74401d941284c0bbd9d123eb547725096
                                                                                                        • Opcode Fuzzy Hash: dab7edca806801eda65346c29c610c66d8dfa477f834f9ce5f7a362220d47429
                                                                                                        • Instruction Fuzzy Hash: 84E1F974E002198FDB54DFA9C5809AEFBF2BF88305F25D159E814AB355DB30A981CF61
                                                                                                        Function 00E3D51C Relevance: .3, Instructions: 264COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1707578148.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_e30000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 3a83cecd93c24c79d158aad484d69829109bc722281bdf7a0f7f25af41e49e18
                                                                                                        • Instruction ID: cf4b7090921a172726589254c8b1d4391e8ab3076f76bb42af6b9535609dd299
                                                                                                        • Opcode Fuzzy Hash: 3a83cecd93c24c79d158aad484d69829109bc722281bdf7a0f7f25af41e49e18
                                                                                                        • Instruction Fuzzy Hash: 4BA16B32E102099FCF15DFA4D94489EBBB2FF85304B1595BAE801BB262DB71ED15CB40
                                                                                                        Function 04CA003F Relevance: .2, Instructions: 217COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712783779.0000000004CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CA0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4ca0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: bc5472d486cd1369278c51ae1e6fac73cf7c78f57c580a6145154cd299350825
                                                                                                        • Instruction ID: 7d753ef7df9056264a6d8336ef5a5d506646b486db786ae695d7221ddbfa903f
                                                                                                        • Opcode Fuzzy Hash: bc5472d486cd1369278c51ae1e6fac73cf7c78f57c580a6145154cd299350825
                                                                                                        • Instruction Fuzzy Hash: D2C1E9B0C917468AD718CF6EE8891897BB1FFC5318F90CB09D1A16B6E0DBB4156ACF44
                                                                                                        Function 06E54FA7 Relevance: .2, Instructions: 157COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 3d3f596bcfbd099e93cc1b061f8ddfb6e9935d96de5d41a5eb46bffb3d7556d8
                                                                                                        • Instruction ID: 9fa788b3e06fc9b467d21e5393ce7975701476923f6499bba769b1416e54c4ec
                                                                                                        • Opcode Fuzzy Hash: 3d3f596bcfbd099e93cc1b061f8ddfb6e9935d96de5d41a5eb46bffb3d7556d8
                                                                                                        • Instruction Fuzzy Hash: BA611A74E002198FCB14DFA9D5809AEFBF2EF89304F25D16AD818AB355D734A941CFA1
                                                                                                        Function 06E56A88 Relevance: .1, Instructions: 147COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1714378269.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_6e50000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: aff7d289e6868845682c038a78237c2ed1b5e917f75a2ecc3df7c025030d2863
                                                                                                        • Instruction ID: 44bcccf422dd979e506b464d3f1d38f678a84a62c0adf5c98a72e32b3bfafe5c
                                                                                                        • Opcode Fuzzy Hash: aff7d289e6868845682c038a78237c2ed1b5e917f75a2ecc3df7c025030d2863
                                                                                                        • Instruction Fuzzy Hash: AC514E75E002198FDB54DFA9C5405AEFBF2FF89304F25D16AD818AB226DB309942CF51

                                                                                                        Execution Graph

                                                                                                        Execution Coverage:10.6%
                                                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                                                        Signature Coverage:0%
                                                                                                        Total number of Nodes:196
                                                                                                        Total number of Limit Nodes:21
                                                                                                        execution_graph 37499 2c3d030 37500 2c3d048 37499->37500 37501 2c3d0a2 37500->37501 37510 69c3118 37500->37510 37516 69c2b1c 37500->37516 37520 69c2b2c 37500->37520 37528 69c7782 37500->37528 37537 69c3240 37500->37537 37541 69c2b04 37500->37541 37545 69c310b 37500->37545 37551 69c7798 37500->37551 37511 69c313e 37510->37511 37512 69c2b1c GetModuleHandleW 37511->37512 37513 69c314a 37512->37513 37514 69c2b2c 2 API calls 37513->37514 37515 69c315f 37514->37515 37515->37501 37517 69c2b27 37516->37517 37559 69c2b54 37517->37559 37519 69c3257 37519->37501 37521 69c2b37 37520->37521 37522 69c7809 37521->37522 37524 69c77f9 37521->37524 37579 69c670c 37522->37579 37567 69c7930 37524->37567 37573 69c7920 37524->37573 37525 69c7807 37525->37525 37529 69c778a 37528->37529 37530 69c779a 37528->37530 37529->37501 37531 69c7809 37530->37531 37533 69c77f9 37530->37533 37532 69c670c 2 API calls 37531->37532 37534 69c7807 37532->37534 37535 69c7930 2 API calls 37533->37535 37536 69c7920 2 API calls 37533->37536 37534->37534 37535->37534 37536->37534 37538 69c321d 37537->37538 37538->37537 37539 69c2b54 GetModuleHandleW 37538->37539 37540 69c3257 37539->37540 37540->37501 37542 69c2b15 37541->37542 37543 69c2b54 GetModuleHandleW 37542->37543 37544 69c3257 37543->37544 37544->37501 37546 69c313e 37545->37546 37547 69c2b1c GetModuleHandleW 37546->37547 37548 69c314a 37547->37548 37549 69c2b2c 2 API calls 37548->37549 37550 69c315f 37549->37550 37550->37501 37553 69c77a8 37551->37553 37552 69c7809 37554 69c670c 2 API calls 37552->37554 37553->37552 37555 69c77f9 37553->37555 37556 69c7807 37554->37556 37557 69c7930 2 API calls 37555->37557 37558 69c7920 2 API calls 37555->37558 37556->37556 37557->37556 37558->37556 37560 69c2b5f 37559->37560 37562 69c331f 37560->37562 37563 69c0424 37560->37563 37564 69c1ab0 GetModuleHandleW 37563->37564 37566 69c1b25 37564->37566 37566->37562 37568 69c793e 37567->37568 37569 69c670c 2 API calls 37568->37569 37570 69c7a16 37568->37570 37586 69c7e10 37568->37586 37591 69c7e00 37568->37591 37569->37568 37570->37525 37574 69c7930 37573->37574 37575 69c670c 2 API calls 37574->37575 37576 69c7a16 37574->37576 37577 69c7e10 OleGetClipboard 37574->37577 37578 69c7e00 OleGetClipboard 37574->37578 37575->37574 37576->37525 37577->37574 37578->37574 37580 69c6717 37579->37580 37581 69c7b1c 37580->37581 37582 69c7a72 37580->37582 37583 69c2b2c OleGetClipboard 37581->37583 37584 69c7aca CallWindowProcW 37582->37584 37585 69c7a79 37582->37585 37583->37585 37584->37585 37585->37525 37587 69c7e2f 37586->37587 37588 69c7e55 37587->37588 37596 69c83b8 37587->37596 37602 69c83c8 37587->37602 37588->37568 37592 69c7e06 37591->37592 37593 69c7df6 37592->37593 37594 69c83b8 OleGetClipboard 37592->37594 37595 69c83c8 OleGetClipboard 37592->37595 37593->37568 37594->37592 37595->37592 37598 69c83c8 37596->37598 37597 69c83e4 37597->37587 37598->37597 37608 69c8410 37598->37608 37619 69c8402 37598->37619 37599 69c83f9 37599->37587 37604 69c83d0 37602->37604 37603 69c83e4 37603->37587 37604->37603 37606 69c8410 OleGetClipboard 37604->37606 37607 69c8402 OleGetClipboard 37604->37607 37605 69c83f9 37605->37587 37606->37605 37607->37605 37609 69c8422 37608->37609 37610 69c843d 37609->37610 37612 69c8481 37609->37612 37615 69c8410 OleGetClipboard 37610->37615 37616 69c8402 OleGetClipboard 37610->37616 37611 69c8443 37611->37599 37614 69c8501 37612->37614 37630 69c86c8 37612->37630 37634 69c86d8 37612->37634 37613 69c851f 37613->37599 37614->37599 37615->37611 37616->37611 37620 69c840a 37619->37620 37621 69c843d 37620->37621 37623 69c8481 37620->37623 37626 69c8410 OleGetClipboard 37621->37626 37627 69c8402 OleGetClipboard 37621->37627 37622 69c8443 37622->37599 37625 69c8501 37623->37625 37628 69c86d8 OleGetClipboard 37623->37628 37629 69c86c8 OleGetClipboard 37623->37629 37624 69c851f 37624->37599 37625->37599 37626->37622 37627->37622 37628->37624 37629->37624 37632 69c86ed 37630->37632 37633 69c8713 37632->37633 37638 69c8120 37632->37638 37633->37613 37636 69c86ed 37634->37636 37635 69c8120 OleGetClipboard 37635->37636 37636->37635 37637 69c8713 37636->37637 37637->37613 37639 69c8780 OleGetClipboard 37638->37639 37641 69c881a 37639->37641 37642 69c85e8 37643 69c85f3 37642->37643 37644 69c8603 37643->37644 37646 69c693c 37643->37646 37647 69c8638 OleInitialize 37646->37647 37648 69c869c 37647->37648 37648->37644 37649 69c0108 37650 69c0115 37649->37650 37651 69c012a 37650->37651 37654 69c1088 37650->37654 37663 69c1073 37650->37663 37655 69c10b3 37654->37655 37672 69c1600 37655->37672 37676 69c15f1 37655->37676 37656 69c1136 37657 69c1162 37656->37657 37658 69c0424 GetModuleHandleW 37656->37658 37657->37657 37659 69c11a6 37658->37659 37659->37657 37662 69c2f57 CreateWindowExW 37659->37662 37662->37657 37664 69c1088 37663->37664 37669 69c1600 GetModuleHandleW 37664->37669 37670 69c15f1 GetModuleHandleW 37664->37670 37665 69c1136 37666 69c1162 37665->37666 37667 69c0424 GetModuleHandleW 37665->37667 37666->37666 37668 69c11a6 37667->37668 37668->37666 37688 69c2f57 37668->37688 37669->37665 37670->37665 37673 69c162d 37672->37673 37674 69c16ae 37673->37674 37680 69c17cf 37673->37680 37674->37674 37677 69c1600 37676->37677 37678 69c16ae 37677->37678 37679 69c17cf GetModuleHandleW 37677->37679 37679->37678 37681 69c17da 37680->37681 37682 69c0424 GetModuleHandleW 37681->37682 37683 69c18fa 37682->37683 37684 69c0424 GetModuleHandleW 37683->37684 37687 69c1974 37683->37687 37685 69c1948 37684->37685 37686 69c0424 GetModuleHandleW 37685->37686 37685->37687 37686->37687 37687->37674 37689 69c2f5a CreateWindowExW 37688->37689 37691 69c2f24 37688->37691 37692 69c3084 37689->37692 37691->37666 37693 69ca168 37694 69ca1ac SetWindowsHookExA 37693->37694 37696 69ca1f2 37694->37696 37697 69c1aab 37698 69c1ab0 GetModuleHandleW 37697->37698 37700 69c1b25 37698->37700 37488 2d071d8 37489 2d0721c CheckRemoteDebuggerPresent 37488->37489 37490 2d0725e 37489->37490 37701 2d00848 37703 2d0084e 37701->37703 37702 2d0091b 37703->37702 37705 2d01498 37703->37705 37706 2d014ae 37705->37706 37707 2d015d6 37706->37707 37709 2d08870 37706->37709 37707->37703 37710 2d0887a 37709->37710 37711 2d08894 37710->37711 37714 6a2fad3 37710->37714 37718 6a2fae0 37710->37718 37711->37706 37716 6a2faf5 37714->37716 37715 6a2fd0a 37715->37711 37716->37715 37717 6a2fd20 GlobalMemoryStatusEx GlobalMemoryStatusEx 37716->37717 37717->37716 37720 6a2faf5 37718->37720 37719 6a2fd0a 37719->37711 37720->37719 37721 6a2fd20 GlobalMemoryStatusEx GlobalMemoryStatusEx 37720->37721 37721->37720 37491 69c7d30 37493 69c7d38 37491->37493 37494 69c7d5b 37493->37494 37495 69c6764 37493->37495 37496 69c7d70 KiUserCallbackDispatcher 37495->37496 37498 69c7dde 37496->37498 37498->37493 37722 69c6ba0 DuplicateHandle 37723 69c6c36 37722->37723

                                                                                                        Executed Functions

                                                                                                        Function 06A23148 Relevance: 8.0, Strings: 6, Instructions: 545COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 125 6a23148-6a23169 126 6a2316b-6a2316e 125->126 127 6a23174-6a23193 126->127 128 6a2390f-6a23912 126->128 137 6a23195-6a23198 127->137 138 6a231ac-6a231b6 127->138 129 6a23914-6a23933 128->129 130 6a23938-6a2393a 128->130 129->130 132 6a23941-6a23944 130->132 133 6a2393c 130->133 132->126 134 6a2394a-6a23953 132->134 133->132 137->138 140 6a2319a-6a231aa 137->140 142 6a231bc-6a231cb 138->142 140->142 251 6a231cd call 6a23961 142->251 252 6a231cd call 6a23968 142->252 144 6a231d2-6a231d7 145 6a231e4-6a234c1 144->145 146 6a231d9-6a231df 144->146 167 6a23901-6a2390e 145->167 168 6a234c7-6a23576 145->168 146->134 177 6a23578-6a2359d 168->177 178 6a2359f 168->178 180 6a235a8-6a235bb 177->180 178->180 182 6a235c1-6a235e3 180->182 183 6a238e8-6a238f4 180->183 182->183 186 6a235e9-6a235f3 182->186 183->168 184 6a238fa 183->184 184->167 186->183 187 6a235f9-6a23604 186->187 187->183 188 6a2360a-6a236e0 187->188 200 6a236e2-6a236e4 188->200 201 6a236ee-6a2371e 188->201 200->201 205 6a23720-6a23722 201->205 206 6a2372c-6a23738 201->206 205->206 207 6a2373a-6a2373e 206->207 208 6a23798-6a2379c 206->208 207->208 209 6a23740-6a2376a 207->209 210 6a237a2-6a237de 208->210 211 6a238d9-6a238e2 208->211 218 6a23778-6a23795 209->218 219 6a2376c-6a2376e 209->219 221 6a237e0-6a237e2 210->221 222 6a237ec-6a237fa 210->222 211->183 211->188 218->208 219->218 221->222 225 6a23811-6a2381c 222->225 226 6a237fc-6a23807 222->226 229 6a23834-6a23845 225->229 230 6a2381e-6a23824 225->230 226->225 231 6a23809 226->231 235 6a23847-6a2384d 229->235 236 6a2385d-6a23869 229->236 232 6a23826 230->232 233 6a23828-6a2382a 230->233 231->225 232->229 233->229 237 6a23851-6a23853 235->237 238 6a2384f 235->238 240 6a23881-6a238d2 236->240 241 6a2386b-6a23871 236->241 237->236 238->236 240->211 242 6a23873 241->242 243 6a23875-6a23877 241->243 242->240 243->240 251->144 252->144
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $^q$$^q$$^q$$^q$$^q$$^q
                                                                                                        • API String ID: 0-2392861976
                                                                                                        • Opcode ID: 2e336f38ce227f6fd992ce71a30edbb6c451818630f9f7a0780c9bcae0b32790
                                                                                                        • Instruction ID: 8ce8ec2ff6eb90df637d359dc4eecd56a82a597429d2c58c7a45fb110db19797
                                                                                                        • Opcode Fuzzy Hash: 2e336f38ce227f6fd992ce71a30edbb6c451818630f9f7a0780c9bcae0b32790
                                                                                                        • Instruction Fuzzy Hash: ED322031E5071A8FCF14EF79C89459DB7B6FF89300F1086A9D409AB265EB309986CB91
                                                                                                        Function 06A27E50 Relevance: 3.0, Strings: 2, Instructions: 479COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 795 6a27e50-6a27e6e 797 6a27e70-6a27e73 795->797 798 6a27e96-6a27e99 797->798 799 6a27e75-6a27e91 797->799 800 6a27eb0-6a27eb3 798->800 801 6a27e9b-6a27ea9 798->801 799->798 802 6a27ec0-6a27ec3 800->802 803 6a27eb5-6a27ebf 800->803 810 6a27ef6-6a27f0c 801->810 811 6a27eab 801->811 806 6a27ee4-6a27ee6 802->806 807 6a27ec5-6a27edf 802->807 808 6a27ee8 806->808 809 6a27eed-6a27ef0 806->809 807->806 808->809 809->797 809->810 815 6a27f12-6a27f1b 810->815 816 6a28127-6a28131 810->816 811->800 818 6a28132-6a28140 815->818 819 6a27f21-6a27f3e 815->819 822 6a28142-6a28167 818->822 823 6a28193-6a281a4 818->823 829 6a28114-6a28121 819->829 830 6a27f44-6a27f6c 819->830 825 6a28169-6a2816c 822->825 828 6a281af-6a281b1 823->828 826 6a2816e-6a2818a 825->826 827 6a2818f-6a28192 825->827 826->827 827->823 831 6a2823f-6a28242 827->831 832 6a281b3-6a281b9 828->832 833 6a281c9-6a281cd 828->833 829->815 829->816 830->829 853 6a27f72-6a27f7b 830->853 837 6a28477-6a28479 831->837 838 6a28248-6a28257 831->838 835 6a281bb 832->835 836 6a281bd-6a281bf 832->836 839 6a281db 833->839 840 6a281cf-6a281d9 833->840 835->833 836->833 843 6a28480-6a28483 837->843 844 6a2847b 837->844 851 6a28276-6a282ba 838->851 852 6a28259-6a28274 838->852 842 6a281e0-6a281e2 839->842 840->842 846 6a281e4-6a281e7 842->846 847 6a281f9-6a28232 842->847 843->825 849 6a28489-6a28492 843->849 844->843 846->849 847->838 874 6a28234-6a2823e 847->874 860 6a282c0-6a282d1 851->860 861 6a2844b-6a28461 851->861 852->851 853->818 854 6a27f81-6a27f9d 853->854 863 6a28102-6a2810e 854->863 864 6a27fa3-6a27fcd 854->864 870 6a28436-6a28445 860->870 871 6a282d7-6a282f4 860->871 861->837 863->829 863->853 880 6a27fd3-6a27ffb 864->880 881 6a280f8-6a280fd 864->881 870->860 870->861 871->870 879 6a282fa-6a283f0 call 6a26678 871->879 930 6a283f2-6a283fc 879->930 931 6a283fe 879->931 880->881 887 6a28001-6a2802f 880->887 881->863 887->881 892 6a28035-6a2803e 887->892 892->881 894 6a28044-6a28076 892->894 902 6a28081-6a2809d 894->902 903 6a28078-6a2807c 894->903 902->863 904 6a2809f-6a280f6 call 6a26678 902->904 903->881 905 6a2807e 903->905 904->863 905->902 932 6a28403-6a28405 930->932 931->932 932->870 933 6a28407-6a2840c 932->933 934 6a2841a 933->934 935 6a2840e-6a28418 933->935 936 6a2841f-6a28421 934->936 935->936 936->870 937 6a28423-6a2842f 936->937 937->870
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $^q$$^q
                                                                                                        • API String ID: 0-355816377
                                                                                                        • Opcode ID: ceec33edfc2fdda32bb1593c4eee3578fbb98a812456288fc71e3fd475a9e9fd
                                                                                                        • Instruction ID: 95521f83eb7ad51c9e20f48603b619632789eec1db0cc8d5e7d29aa1aba3fa6f
                                                                                                        • Opcode Fuzzy Hash: ceec33edfc2fdda32bb1593c4eee3578fbb98a812456288fc71e3fd475a9e9fd
                                                                                                        • Instruction Fuzzy Hash: 0202CE30B502268FDB14EB69D9806AEB7F2FF84304F148569E419DB394DB35EC86CB91
                                                                                                        Function 06A25680 Relevance: 1.8, Strings: 1, Instructions: 591COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $
                                                                                                        • API String ID: 0-3993045852
                                                                                                        • Opcode ID: e10065ff168c07e15dabd576fb7681d2962e9fd48b50698b812e4e681c3b479a
                                                                                                        • Instruction ID: c7846b16cdad95938158efd3e0002483d7312fd62e01697a9e74f53f31796708
                                                                                                        • Opcode Fuzzy Hash: e10065ff168c07e15dabd576fb7681d2962e9fd48b50698b812e4e681c3b479a
                                                                                                        • Instruction Fuzzy Hash: 3422D275E502269FDF64EBA8C4846AEB7B2FF85324F208469D449AF344D731DC41CB91
                                                                                                        Function 02D071D8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 02D0724F
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4138894271.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_2d00000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CheckDebuggerPresentRemote
                                                                                                        • String ID:
                                                                                                        • API String ID: 3662101638-0
                                                                                                        • Opcode ID: 3e4cddf66bb02443eac9b0081294e5ecc2491cd2454baa84c981dfcb56c16a4c
                                                                                                        • Instruction ID: ef676bf8116dd6ccc5e196fb793419e1a5beaf8ae878cad070253af62213a884
                                                                                                        • Opcode Fuzzy Hash: 3e4cddf66bb02443eac9b0081294e5ecc2491cd2454baa84c981dfcb56c16a4c
                                                                                                        • Instruction Fuzzy Hash: 3B2148B1800259CFDB10CFAAC484BEEFBF4AF49320F14846AE459A7350D738A944CF61
                                                                                                        Function 06A266C8 Relevance: .8, Instructions: 817COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: dcd720cfcc2ce9da9618cea5478c3bc665b3848a075b56b1a411c79a14423172
                                                                                                        • Instruction ID: f4f5e6abe4dcf272711f9febc0f80e15b5ef29af99475eb37ba286163e0d8623
                                                                                                        • Opcode Fuzzy Hash: dcd720cfcc2ce9da9618cea5478c3bc665b3848a075b56b1a411c79a14423172
                                                                                                        • Instruction Fuzzy Hash: F862AE30B512268FDB54EB68D584AAEB7F2FF88304F148469E409DB395DB31ED46CB90
                                                                                                        Function 06A2C240 Relevance: .6, Instructions: 647COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 88986581d46d122d815f8fbeceb24526ac7badd85ccaeebbc9b779fc81491852
                                                                                                        • Instruction ID: a21b03175247f58aef14d3798aedb2248ae71b80109d3df3474897943076032e
                                                                                                        • Opcode Fuzzy Hash: 88986581d46d122d815f8fbeceb24526ac7badd85ccaeebbc9b779fc81491852
                                                                                                        • Instruction Fuzzy Hash: D6328F30B402269FDF94EB6DD990BAEB7B2FB88360F108525E406DB355DB35DC428B91
                                                                                                        Function 06A2B2F9 Relevance: .6, Instructions: 562COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 5b090602b0815469f1a17de6cbb26881a262de31136556acb65dd7d24defdf09
                                                                                                        • Instruction ID: 5b063c0a638e7fe554f743c99943a4a3e6d6574bb62b0e76257685ff91256c41
                                                                                                        • Opcode Fuzzy Hash: 5b090602b0815469f1a17de6cbb26881a262de31136556acb65dd7d24defdf09
                                                                                                        • Instruction Fuzzy Hash: 96226F30E5011A8FEF64EB6DD5807AEB7B2FB85314F208925E409EB391DB35DC818B61
                                                                                                        Function 06A2ADA0 Relevance: 10.4, Strings: 8, Instructions: 390COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 0 6a2ada0-6a2adbe 1 6a2adc0-6a2adc3 0->1 2 6a2add4-6a2add7 1->2 3 6a2adc5-6a2adc9 1->3 6 6a2ade1-6a2ade4 2->6 7 6a2add9-6a2adde 2->7 4 6a2adcf 3->4 5 6a2afcc-6a2afd6 3->5 4->2 8 6a2ade6-6a2adf3 6->8 9 6a2adf8-6a2adfb 6->9 7->6 8->9 10 6a2ae15-6a2ae18 9->10 11 6a2adfd-6a2ae06 9->11 15 6a2ae1e-6a2ae21 10->15 16 6a2afbd-6a2afc6 10->16 13 6a2afd7-6a2b00e 11->13 14 6a2ae0c-6a2ae10 11->14 22 6a2b010-6a2b013 13->22 14->10 17 6a2ae23-6a2ae3f 15->17 18 6a2ae44-6a2ae47 15->18 16->5 16->11 17->18 19 6a2ae61-6a2ae64 18->19 20 6a2ae49-6a2ae5c 18->20 23 6a2ae66-6a2ae6f 19->23 24 6a2ae74-6a2ae76 19->24 20->19 29 6a2b019-6a2b054 22->29 30 6a2b27c-6a2b27f 22->30 23->24 27 6a2ae78 24->27 28 6a2ae7d-6a2ae80 24->28 27->28 28->1 34 6a2ae86-6a2aeaa 28->34 38 6a2b247-6a2b25a 29->38 39 6a2b05a-6a2b066 29->39 31 6a2b2a2-6a2b2a5 30->31 32 6a2b281-6a2b29d 30->32 36 6a2b2b6-6a2b2b9 31->36 37 6a2b2a7-6a2b2ab 31->37 32->31 53 6a2aeb0-6a2aebf 34->53 54 6a2afba 34->54 42 6a2b2c6-6a2b2c9 36->42 43 6a2b2bb-6a2b2c5 36->43 37->29 41 6a2b2b1 37->41 47 6a2b25c-6a2b25d 38->47 56 6a2b086-6a2b0ca 39->56 57 6a2b068-6a2b081 39->57 41->36 45 6a2b2cb call 6a2b2f9 42->45 46 6a2b2d8-6a2b2da 42->46 59 6a2b2d1-6a2b2d3 45->59 50 6a2b2e1-6a2b2e4 46->50 51 6a2b2dc 46->51 47->30 50->22 55 6a2b2ea-6a2b2f4 50->55 51->50 62 6a2aec1-6a2aec7 53->62 63 6a2aed7-6a2af12 call 6a26678 53->63 54->16 74 6a2b0e6-6a2b125 56->74 75 6a2b0cc-6a2b0de 56->75 57->47 59->46 65 6a2aecb-6a2aecd 62->65 66 6a2aec9 62->66 82 6a2af14-6a2af1a 63->82 83 6a2af2a-6a2af41 63->83 65->63 66->63 80 6a2b12b-6a2b206 call 6a26678 74->80 81 6a2b20c-6a2b221 74->81 75->74 80->81 81->38 84 6a2af1e-6a2af20 82->84 85 6a2af1c 82->85 93 6a2af43-6a2af49 83->93 94 6a2af59-6a2af6a 83->94 84->83 85->83 96 6a2af4b 93->96 97 6a2af4d-6a2af4f 93->97 99 6a2af82-6a2afb3 94->99 100 6a2af6c-6a2af72 94->100 96->94 97->94 99->54 102 6a2af76-6a2af78 100->102 103 6a2af74 100->103 102->99 103->99
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                                        • API String ID: 0-3823777903
                                                                                                        • Opcode ID: 016dcbf348b9618e3f22bf5efc2869dac17008a9dc69c1a55c7b0f77e72e5fa3
                                                                                                        • Instruction ID: 22091e7d41de9090f24727dd9d44e9bfc57e28f9b14eaaafb259e1a4adb998df
                                                                                                        • Opcode Fuzzy Hash: 016dcbf348b9618e3f22bf5efc2869dac17008a9dc69c1a55c7b0f77e72e5fa3
                                                                                                        • Instruction Fuzzy Hash: 27E18D30E5022A8FDB69EFA9D5806AEB7B2FF85304F208529D505EB354DB34DC46CB91
                                                                                                        Function 06A2B710 Relevance: 8.0, Strings: 6, Instructions: 472COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 253 6a2b710-6a2b730 254 6a2b732-6a2b735 253->254 255 6a2b737-6a2b73b 254->255 256 6a2b74c-6a2b74f 254->256 257 6a2b741-6a2b747 255->257 258 6a2baa5-6a2bade 255->258 259 6a2b761-6a2b764 256->259 260 6a2b751 256->260 257->256 270 6a2bae0-6a2bae3 258->270 261 6a2b771-6a2b774 259->261 262 6a2b766-6a2b76c 259->262 263 6a2b759-6a2b75c 260->263 264 6a2b776-6a2b77a 261->264 265 6a2b797-6a2b79a 261->265 262->261 263->259 264->258 269 6a2b780-6a2b790 264->269 267 6a2b7b1-6a2b7b4 265->267 268 6a2b79c-6a2b7a0 265->268 272 6a2b7b6-6a2b7ba 267->272 273 6a2b7d7-6a2b7da 267->273 268->258 271 6a2b7a6-6a2b7ac 268->271 269->272 282 6a2b792 269->282 274 6a2bb06-6a2bb09 270->274 275 6a2bae5-6a2bb01 270->275 271->267 272->258 278 6a2b7c0-6a2b7d0 272->278 279 6a2b7e4-6a2b7e7 273->279 280 6a2b7dc-6a2b7df 273->280 276 6a2bd75-6a2bd77 274->276 277 6a2bb0f-6a2bb37 274->277 275->274 284 6a2bd79 276->284 285 6a2bd7e-6a2bd81 276->285 316 6a2bb41-6a2bb85 277->316 317 6a2bb39-6a2bb3c 277->317 278->280 297 6a2b7d2 278->297 286 6a2b7f1-6a2b7f4 279->286 287 6a2b7e9-6a2b7ee 279->287 280->279 282->265 284->285 285->270 288 6a2bd87-6a2bd90 285->288 291 6a2b7f6-6a2b7fd 286->291 292 6a2b808-6a2b80b 286->292 287->286 293 6a2b803 291->293 294 6a2ba16-6a2ba1f 291->294 292->280 295 6a2b80d-6a2b810 292->295 293->292 300 6a2ba24-6a2ba27 294->300 298 6a2b812-6a2b81e 295->298 299 6a2b823-6a2b826 295->299 297->273 298->299 302 6a2b828-6a2b82c 299->302 303 6a2b84d-6a2b850 299->303 304 6a2ba3a-6a2ba3d 300->304 305 6a2ba29-6a2ba2d 300->305 302->258 307 6a2b832-6a2b842 302->307 312 6a2b852-6a2b85b 303->312 313 6a2b866-6a2b869 303->313 310 6a2ba3f-6a2ba45 304->310 311 6a2ba4c-6a2ba4f 304->311 305->258 308 6a2ba2f-6a2ba35 305->308 307->264 336 6a2b848 307->336 308->304 318 6a2ba47 310->318 319 6a2b9f9-6a2b9ff 310->319 311->280 322 6a2ba55-6a2ba58 311->322 320 6a2b902-6a2b90b 312->320 321 6a2b861 312->321 314 6a2b86b-6a2b8b9 call 6a26678 313->314 315 6a2b8be-6a2b8c1 313->315 314->315 315->280 323 6a2b8c7-6a2b8ca 315->323 361 6a2bd6a-6a2bd74 316->361 362 6a2bb8b-6a2bb94 316->362 317->288 318->311 319->258 326 6a2ba05-6a2ba0c 319->326 320->258 327 6a2b911-6a2b918 320->327 321->313 324 6a2ba5a-6a2ba76 322->324 325 6a2ba7b-6a2ba7e 322->325 329 6a2b8d4-6a2b8d7 323->329 330 6a2b8cc-6a2b8cf 323->330 324->325 332 6a2ba80-6a2ba83 325->332 333 6a2ba88-6a2ba8a 325->333 334 6a2ba11-6a2ba14 326->334 335 6a2b91d-6a2b920 327->335 329->312 339 6a2b8dd-6a2b8e0 329->339 330->329 332->333 341 6a2ba91-6a2ba94 333->341 342 6a2ba8c 333->342 334->294 334->300 335->310 343 6a2b926-6a2b929 335->343 336->303 345 6a2b8e2-6a2b8eb 339->345 346 6a2b8f0-6a2b8f3 339->346 341->254 348 6a2ba9a-6a2baa4 341->348 342->341 349 6a2b92b-6a2b934 343->349 350 6a2b939-6a2b93c 343->350 345->346 352 6a2b8f5-6a2b8fa 346->352 353 6a2b8fd-6a2b900 346->353 349->350 354 6a2b97b-6a2b97e 350->354 355 6a2b93e-6a2b953 350->355 352->353 353->320 353->335 357 6a2b980-6a2b995 354->357 358 6a2b9bc-6a2b9bf 354->358 355->258 365 6a2b959-6a2b976 355->365 357->258 372 6a2b99b-6a2b9b7 357->372 363 6a2b9c1-6a2b9ca 358->363 364 6a2b9cf-6a2b9d2 358->364 366 6a2bd60-6a2bd65 362->366 367 6a2bb9a-6a2bc06 call 6a26678 362->367 363->364 370 6a2b9f4-6a2b9f7 364->370 371 6a2b9d4-6a2b9ef 364->371 365->354 366->361 387 6a2bd00-6a2bd15 367->387 388 6a2bc0c-6a2bc11 367->388 370->319 370->334 371->370 372->358 387->366 389 6a2bc13-6a2bc19 388->389 390 6a2bc2d 388->390 392 6a2bc1b-6a2bc1d 389->392 393 6a2bc1f-6a2bc21 389->393 394 6a2bc2f-6a2bc35 390->394 395 6a2bc2b 392->395 393->395 396 6a2bc37-6a2bc3d 394->396 397 6a2bc4a-6a2bc57 394->397 395->394 398 6a2bc43 396->398 399 6a2bceb-6a2bcfa 396->399 404 6a2bc59-6a2bc5f 397->404 405 6a2bc6f-6a2bc7c 397->405 398->397 400 6a2bcb2-6a2bcbf 398->400 401 6a2bc7e-6a2bc8b 398->401 399->387 399->388 410 6a2bcc1-6a2bcc7 400->410 411 6a2bcd7-6a2bce4 400->411 413 6a2bca3-6a2bcb0 401->413 414 6a2bc8d-6a2bc93 401->414 408 6a2bc63-6a2bc65 404->408 409 6a2bc61 404->409 405->399 408->405 409->405 415 6a2bccb-6a2bccd 410->415 416 6a2bcc9 410->416 411->399 413->399 417 6a2bc97-6a2bc99 414->417 418 6a2bc95 414->418 415->411 416->411 417->413 418->413
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $^q$$^q$$^q$$^q$$^q$$^q
                                                                                                        • API String ID: 0-2392861976
                                                                                                        • Opcode ID: 4509db13554775e6d5714d475053413a3bea418e1a78fbffb65a4b0880858902
                                                                                                        • Instruction ID: 05294f3bbc45ca6c21a3dc472ab143571590a6d93b9910e7cb7c29b5082a4209
                                                                                                        • Opcode Fuzzy Hash: 4509db13554775e6d5714d475053413a3bea418e1a78fbffb65a4b0880858902
                                                                                                        • Instruction Fuzzy Hash: E6026E30E5022A8FDB64EF6CD5806ADB7B2FB85718F10892AD405DF255DB30EC85CBA1
                                                                                                        Function 06A29228 Relevance: 5.2, Strings: 4, Instructions: 230COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 421 6a29228-6a2924d 422 6a2924f-6a29252 421->422 423 6a29b10-6a29b13 422->423 424 6a29258-6a2926d 422->424 425 6a29b15-6a29b34 423->425 426 6a29b39-6a29b3b 423->426 431 6a29285-6a2929b 424->431 432 6a2926f-6a29275 424->432 425->426 428 6a29b42-6a29b45 426->428 429 6a29b3d 426->429 428->422 433 6a29b4b-6a29b55 428->433 429->428 438 6a292a6-6a292a8 431->438 434 6a29277 432->434 435 6a29279-6a2927b 432->435 434->431 435->431 439 6a292c0-6a29331 438->439 440 6a292aa-6a292b0 438->440 451 6a29333-6a29356 439->451 452 6a2935d-6a29379 439->452 441 6a292b2 440->441 442 6a292b4-6a292b6 440->442 441->439 442->439 451->452 457 6a293a5-6a293c0 452->457 458 6a2937b-6a2939e 452->458 463 6a293c2-6a293e4 457->463 464 6a293eb-6a29406 457->464 458->457 463->464 469 6a2942b-6a29439 464->469 470 6a29408-6a29424 464->470 471 6a2943b-6a29444 469->471 472 6a29449-6a294c3 469->472 470->469 471->433 478 6a29510-6a29525 472->478 479 6a294c5-6a294e3 472->479 478->423 483 6a294e5-6a294f4 479->483 484 6a294ff-6a2950e 479->484 483->484 484->478 484->479
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $^q$$^q$$^q$$^q
                                                                                                        • API String ID: 0-2125118731
                                                                                                        • Opcode ID: e94d2834089825b2b5f098f26dd13714844aeb99fe9c5db1c74e17b63a9a4cfa
                                                                                                        • Instruction ID: c283d4ac4148a741dbb7c68b4dfe2c533d59fea260187a98e4a37bd849fe2d38
                                                                                                        • Opcode Fuzzy Hash: e94d2834089825b2b5f098f26dd13714844aeb99fe9c5db1c74e17b63a9a4cfa
                                                                                                        • Instruction Fuzzy Hash: 5D914230B1022A9FDB54EF6AD9507AFB3F6AB85704F108569D409EB384EB70DC468B91
                                                                                                        Function 06A2CFF8 Relevance: 4.6, Strings: 3, Instructions: 800COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 487 6a2cff8-6a2d013 488 6a2d015-6a2d018 487->488 489 6a2d061-6a2d064 488->489 490 6a2d01a-6a2d029 488->490 491 6a2d066-6a2d0a8 489->491 492 6a2d0ad-6a2d0b0 489->492 493 6a2d02b-6a2d030 490->493 494 6a2d038-6a2d044 490->494 491->492 495 6a2d0b2-6a2d0f4 492->495 496 6a2d0f9-6a2d0fc 492->496 493->494 497 6a2da15-6a2da28 494->497 498 6a2d04a-6a2d05c 494->498 495->496 500 6a2d106-6a2d109 496->500 501 6a2d0fe-6a2d103 496->501 507 6a2da32-6a2da4e 497->507 508 6a2da2a-6a2da2d 497->508 498->489 503 6a2d4e4-6a2d4f0 500->503 504 6a2d10f-6a2d112 500->504 501->500 503->490 510 6a2d4f6-6a2d7e3 503->510 511 6a2d114-6a2d156 504->511 512 6a2d15b-6a2d15e 504->512 514 6a2da50-6a2da53 507->514 508->507 701 6a2da0a-6a2da14 510->701 702 6a2d7e9-6a2d7ef 510->702 511->512 515 6a2d160-6a2d17c 512->515 516 6a2d181-6a2d184 512->516 517 6a2da62-6a2da65 514->517 518 6a2da55 call 6a2db6d 514->518 515->516 521 6a2d186-6a2d195 516->521 522 6a2d1cd-6a2d1d0 516->522 528 6a2da67-6a2da93 517->528 529 6a2da98-6a2da9b 517->529 537 6a2da5b-6a2da5d 518->537 530 6a2d197-6a2d19c 521->530 531 6a2d1a4-6a2d1b0 521->531 525 6a2d1d2-6a2d1d4 522->525 526 6a2d1df-6a2d1e2 522->526 533 6a2d4e1 525->533 534 6a2d1da 525->534 535 6a2d1e4-6a2d226 526->535 536 6a2d22b-6a2d22e 526->536 528->529 539 6a2dabe-6a2dac0 529->539 540 6a2da9d-6a2dab9 529->540 530->531 531->497 532 6a2d1b6-6a2d1c8 531->532 532->522 533->503 534->526 535->536 546 6a2d230-6a2d232 536->546 547 6a2d23d-6a2d240 536->547 537->517 543 6a2dac2 539->543 544 6a2dac7-6a2daca 539->544 540->539 543->544 544->514 552 6a2dacc-6a2dadb 544->552 553 6a2d238 546->553 554 6a2d39f-6a2d3a8 546->554 555 6a2d242-6a2d284 547->555 556 6a2d289-6a2d28c 547->556 576 6a2db42-6a2db57 552->576 577 6a2dadd-6a2db40 call 6a26678 552->577 553->547 563 6a2d3b7-6a2d3c3 554->563 564 6a2d3aa-6a2d3af 554->564 555->556 560 6a2d2a9-6a2d2ac 556->560 561 6a2d28e-6a2d2a4 556->561 571 6a2d2f5-6a2d2f8 560->571 572 6a2d2ae-6a2d2f0 560->572 561->560 567 6a2d4d4-6a2d4d9 563->567 568 6a2d3c9-6a2d3dd 563->568 564->563 567->533 568->533 594 6a2d3e3-6a2d3f5 568->594 578 6a2d341-6a2d344 571->578 579 6a2d2fa-6a2d33c 571->579 572->571 577->576 580 6a2d346-6a2d388 578->580 581 6a2d38d-6a2d38f 578->581 579->578 580->581 592 6a2d391 581->592 593 6a2d396-6a2d399 581->593 592->593 593->488 593->554 609 6a2d3f7-6a2d3fd 594->609 610 6a2d419-6a2d41b 594->610 614 6a2d401-6a2d40d 609->614 615 6a2d3ff 609->615 613 6a2d425-6a2d431 610->613 626 6a2d433-6a2d43d 613->626 627 6a2d43f 613->627 621 6a2d40f-6a2d417 614->621 615->621 621->613 632 6a2d444-6a2d446 626->632 627->632 632->533 635 6a2d44c-6a2d468 call 6a26678 632->635 645 6a2d477-6a2d483 635->645 646 6a2d46a-6a2d46f 635->646 645->567 648 6a2d485-6a2d4d2 645->648 646->645 648->533 703 6a2d7f1-6a2d7f6 702->703 704 6a2d7fe-6a2d807 702->704 703->704 704->497 705 6a2d80d-6a2d820 704->705 707 6a2d826-6a2d82c 705->707 708 6a2d9fa-6a2da04 705->708 709 6a2d83b-6a2d844 707->709 710 6a2d82e-6a2d833 707->710 708->701 708->702 709->497 711 6a2d84a-6a2d86b 709->711 710->709 714 6a2d87a-6a2d883 711->714 715 6a2d86d-6a2d872 711->715 714->497 716 6a2d889-6a2d8a6 714->716 715->714 716->708 719 6a2d8ac-6a2d8b2 716->719 719->497 720 6a2d8b8-6a2d8d1 719->720 722 6a2d8d7-6a2d8fe 720->722 723 6a2d9ed-6a2d9f4 720->723 722->497 726 6a2d904-6a2d90e 722->726 723->708 723->719 726->497 727 6a2d914-6a2d92b 726->727 729 6a2d93a-6a2d955 727->729 730 6a2d92d-6a2d938 727->730 729->723 735 6a2d95b-6a2d974 call 6a26678 729->735 730->729 739 6a2d983-6a2d98c 735->739 740 6a2d976-6a2d97b 735->740 739->497 741 6a2d992-6a2d9e6 739->741 740->739 741->723
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $^q$$^q$$^q
                                                                                                        • API String ID: 0-831282457
                                                                                                        • Opcode ID: fe7c982ecf4d3f8023d266b73a2257d23548320001e9041940bc658bc43aef20
                                                                                                        • Instruction ID: cbdeeaf2856adc4cda575b810ac9403bc126edee97df20056702bf00e670a5ee
                                                                                                        • Opcode Fuzzy Hash: fe7c982ecf4d3f8023d266b73a2257d23548320001e9041940bc658bc43aef20
                                                                                                        • Instruction Fuzzy Hash: 12623430A4021A9FCB55EF69D590A5EB7F2FF84344F108A69D0099F369DB71ED4ACB80
                                                                                                        Function 06A24C50 Relevance: 3.9, Strings: 3, Instructions: 186COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 749 6a24c50-6a24c74 750 6a24c76-6a24c79 749->750 751 6a24c9a-6a24c9d 750->751 752 6a24c7b-6a24c95 750->752 753 6a24ca3-6a24d9b 751->753 754 6a2537c-6a2537e 751->754 752->751 772 6a24da1-6a24db9 753->772 773 6a24e1e-6a24e25 753->773 755 6a25380 754->755 756 6a25385-6a25388 754->756 755->756 756->750 759 6a2538e-6a2539b 756->759 780 6a24dc1-6a24e10 772->780 774 6a24e2b-6a24e9b 773->774 775 6a24ea9-6a24eb2 773->775 792 6a24ea6 774->792 793 6a24e9d 774->793 775->759 790 6a24e12 780->790 791 6a24e1b-6a24e1c 780->791 790->791 791->773 792->775 793->792
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: fcq$XPcq$\Ocq
                                                                                                        • API String ID: 0-3575482020
                                                                                                        • Opcode ID: cb000bdd143e723b37aebb688894315a7c7fc0f2cf6c9078989c9c42c742f3d4
                                                                                                        • Instruction ID: 67a7a113e134e5128cba65310c13721d9728a20493e35164792c31a3e01fb6fa
                                                                                                        • Opcode Fuzzy Hash: cb000bdd143e723b37aebb688894315a7c7fc0f2cf6c9078989c9c42c742f3d4
                                                                                                        • Instruction Fuzzy Hash: A0617030F502199FEF54EFA9C8547AEBBF6FB88700F208529D106AB395DB708C459B91
                                                                                                        Function 06A2A47A Relevance: 2.7, Strings: 2, Instructions: 241COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1175 6a2a47a-6a2a481 1176 6a2a483-6a2a484 1175->1176 1177 6a2a420-6a2a435 1175->1177 1178 6a2a486-6a2a496 1176->1178 1179 6a2a499-6a2a4a8 1176->1179 1189 6a2a43a-6a2a43d 1177->1189 1178->1179 1181 6a2a4aa-6a2a4ad 1179->1181 1182 6a2a4ba-6a2a4bd 1181->1182 1183 6a2a4af-6a2a4b9 1181->1183 1185 6a2a4bf-6a2a4d8 1182->1185 1186 6a2a4dd-6a2a4e0 1182->1186 1185->1186 1187 6a2a4e2-6a2a4fe 1186->1187 1188 6a2a503-6a2a506 1186->1188 1187->1188 1190 6a2a5b2-6a2a5b5 1188->1190 1191 6a2a50c-6a2a5a5 call 6a22138 1188->1191 1192 6a2a45f-6a2a461 1189->1192 1193 6a2a43f 1189->1193 1198 6a2a5d0-6a2a5d3 1190->1198 1199 6a2a5b7-6a2a5c5 1190->1199 1205 6a2a5d9-6a2a606 call 6a22138 1191->1205 1234 6a2a5a7-6a2a5b1 1191->1234 1195 6a2a463 1192->1195 1196 6a2a468-6a2a46b 1192->1196 1206 6a2a44b-6a2a45a 1193->1206 1195->1196 1201 6a2a3f0-6a2a3f3 1196->1201 1202 6a2a46d-6a2a471 1196->1202 1204 6a2a704-6a2a706 1198->1204 1198->1205 1199->1191 1214 6a2a5cb 1199->1214 1208 6a2a415-6a2a418 1201->1208 1209 6a2a3f5-6a2a410 1201->1209 1211 6a2a708 1204->1211 1212 6a2a70d-6a2a710 1204->1212 1229 6a2a6f9-6a2a703 1205->1229 1230 6a2a60c-6a2a631 1205->1230 1206->1192 1208->1189 1217 6a2a41a 1208->1217 1209->1208 1211->1212 1212->1181 1215 6a2a716-6a2a71f 1212->1215 1214->1198 1217->1177 1236 6a2a633-6a2a639 1230->1236 1237 6a2a63b 1230->1237 1238 6a2a641-6a2a6f3 call 6a26678 call 6a22138 1236->1238 1237->1238 1238->1229 1238->1230
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: X!@$x!@
                                                                                                        • API String ID: 0-2527372166
                                                                                                        • Opcode ID: aaa70592c54acefc2e5f5992b23af5e40f8c1366cd1df6e4aec7d232ada08592
                                                                                                        • Instruction ID: ff0ab8d6bb663037d7a74af13216a9ef23707bf51e145979af50a8d415e84d1c
                                                                                                        • Opcode Fuzzy Hash: aaa70592c54acefc2e5f5992b23af5e40f8c1366cd1df6e4aec7d232ada08592
                                                                                                        • Instruction Fuzzy Hash: 3F819031B102169FCB55EB6CD88069EB7B6FB88310F108979E50AEB754DB31DC46CB90
                                                                                                        Function 06A29218 Relevance: 2.7, Strings: 2, Instructions: 165COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1352 6a29218-6a2924d 1354 6a2924f-6a29252 1352->1354 1355 6a29b10-6a29b13 1354->1355 1356 6a29258-6a2926d 1354->1356 1357 6a29b15-6a29b34 1355->1357 1358 6a29b39-6a29b3b 1355->1358 1363 6a29285-6a2929b 1356->1363 1364 6a2926f-6a29275 1356->1364 1357->1358 1360 6a29b42-6a29b45 1358->1360 1361 6a29b3d 1358->1361 1360->1354 1365 6a29b4b-6a29b55 1360->1365 1361->1360 1370 6a292a6-6a292a8 1363->1370 1366 6a29277 1364->1366 1367 6a29279-6a2927b 1364->1367 1366->1363 1367->1363 1371 6a292c0-6a29331 1370->1371 1372 6a292aa-6a292b0 1370->1372 1383 6a29333-6a29356 1371->1383 1384 6a2935d-6a29379 1371->1384 1373 6a292b2 1372->1373 1374 6a292b4-6a292b6 1372->1374 1373->1371 1374->1371 1383->1384 1389 6a293a5-6a293c0 1384->1389 1390 6a2937b-6a2939e 1384->1390 1395 6a293c2-6a293e4 1389->1395 1396 6a293eb-6a29406 1389->1396 1390->1389 1395->1396 1401 6a2942b-6a29439 1396->1401 1402 6a29408-6a29424 1396->1402 1403 6a2943b-6a29444 1401->1403 1404 6a29449-6a294c3 1401->1404 1402->1401 1403->1365 1410 6a29510-6a29525 1404->1410 1411 6a294c5-6a294e3 1404->1411 1410->1355 1415 6a294e5-6a294f4 1411->1415 1416 6a294ff-6a2950e 1411->1416 1415->1416 1416->1410 1416->1411
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $^q$$^q
                                                                                                        • API String ID: 0-355816377
                                                                                                        • Opcode ID: 57e16a049f56fcff7332a1c2849bf0ed0e4f4703fcb6a435ffcc641993a02b5a
                                                                                                        • Instruction ID: 7c4f0e22589515c40acad304f9fa58e063ce71a8d52031ce3bd35e73f2d53e0f
                                                                                                        • Opcode Fuzzy Hash: 57e16a049f56fcff7332a1c2849bf0ed0e4f4703fcb6a435ffcc641993a02b5a
                                                                                                        • Instruction Fuzzy Hash: E1514E30B1011A9FDB54EB6AD990BAFB3F6AB88704F108569D409DB385EB30DC438B91
                                                                                                        Function 06A24C40 Relevance: 2.6, Strings: 2, Instructions: 143COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: fcq$XPcq
                                                                                                        • API String ID: 0-936005338
                                                                                                        • Opcode ID: ce1c6083ec6e6bf5572e964be40528a598bac76d2df536f740cecf56e8490038
                                                                                                        • Instruction ID: 15334c5c7e65f6b8c52f8c9ed9dac717bc6c471fe40e994b49725dce63e91ac4
                                                                                                        • Opcode Fuzzy Hash: ce1c6083ec6e6bf5572e964be40528a598bac76d2df536f740cecf56e8490038
                                                                                                        • Instruction Fuzzy Hash: 4F516270B102199FEB55DFA9C8547AEBAF6FF88700F208529E105AB395DB708C059B91
                                                                                                        Function 069C2F57 Relevance: 1.6, APIs: 1, Instructions: 137COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069C3072
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 716092398-0
                                                                                                        • Opcode ID: 8feb77dde7052be332e40c8a29045e43d285404240234dc046d65ed71ef03402
                                                                                                        • Instruction ID: 287590f51616a49bd74ca3c476e79c5818b2ee7eb0716493796d1d429431267b
                                                                                                        • Opcode Fuzzy Hash: 8feb77dde7052be332e40c8a29045e43d285404240234dc046d65ed71ef03402
                                                                                                        • Instruction Fuzzy Hash: B051E1B1D00209EFDF15CFA9C984ADEBBB5FF49310F24812AE418AB224D7719945CF92
                                                                                                        Function 02D0F2B8 Relevance: 1.6, APIs: 1, Instructions: 137COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4138894271.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_2d00000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 368207f7d6bf404f22f8eae1cc60d1ac997c7742be7411277c093fcb12bbfb56
                                                                                                        • Instruction ID: 258b339afcf8274dceef2a0a992c594ec2d01b203d7879ec88eb9e317b826267
                                                                                                        • Opcode Fuzzy Hash: 368207f7d6bf404f22f8eae1cc60d1ac997c7742be7411277c093fcb12bbfb56
                                                                                                        • Instruction Fuzzy Hash: A5413472D043968FCB10CFB9D8042EEBFF1AF89210F1485AAE444A7790DB389841CBE1
                                                                                                        Function 069C2F60 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069C3072
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 716092398-0
                                                                                                        • Opcode ID: c6f37fa1dbd5133f9a93206f333f47048b1d9920b5996484e5912cb4a65f2ded
                                                                                                        • Instruction ID: 75231b853da6c4b7cfb6f060c8b711a83ba492dba42ee0572e2a110a37a1b41b
                                                                                                        • Opcode Fuzzy Hash: c6f37fa1dbd5133f9a93206f333f47048b1d9920b5996484e5912cb4a65f2ded
                                                                                                        • Instruction Fuzzy Hash: 6541C0B1D00309DFDB14CF99C884ADEBBB5BF48310F24852AE819AB250D771A985CF91
                                                                                                        Function 069C670C Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CallWindowProcW.USER32(?,?,?,?,?), ref: 069C7AF1
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CallProcWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 2714655100-0
                                                                                                        • Opcode ID: 51e683a15b29d22433d5c9f11db42c34602502e9d7fa33108262b081e0d3ac89
                                                                                                        • Instruction ID: 3839890473e34e46b1f4bbafd906e33bfd9dd5730ce76340b455c52014f15231
                                                                                                        • Opcode Fuzzy Hash: 51e683a15b29d22433d5c9f11db42c34602502e9d7fa33108262b081e0d3ac89
                                                                                                        • Instruction Fuzzy Hash: 0F411CB4900305CFDB54CF99C888AAABBF5FB88324F24C85DD519AB721D774A941CFA1
                                                                                                        Function 069C8775 Relevance: 1.6, APIs: 1, Instructions: 76comclipboardCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Clipboard
                                                                                                        • String ID:
                                                                                                        • API String ID: 220874293-0
                                                                                                        • Opcode ID: a697c5a4df367bfa53c112c8c3e52b5673c95ac075c26c1a4fc443eeea0d4d77
                                                                                                        • Instruction ID: 377cb4fb6e059511bc7fd97cc310dd81fdc9cba988c485ee17b4f42a3edb358d
                                                                                                        • Opcode Fuzzy Hash: a697c5a4df367bfa53c112c8c3e52b5673c95ac075c26c1a4fc443eeea0d4d77
                                                                                                        • Instruction Fuzzy Hash: 7D3110B0D01208EFDB20CF99C984BCEBFF5AB48314F208419E405BB694DB75A845CBA2
                                                                                                        Function 069C8120 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Clipboard
                                                                                                        • String ID:
                                                                                                        • API String ID: 220874293-0
                                                                                                        • Opcode ID: fb4672b50b25316d06b891c9826057d463f3eb9c196b68b8bf60d7a2d9680f25
                                                                                                        • Instruction ID: 998a83b00738a18bd56e4ce0eab921dbad5f545539cc41a84d6aa258aac794a6
                                                                                                        • Opcode Fuzzy Hash: fb4672b50b25316d06b891c9826057d463f3eb9c196b68b8bf60d7a2d9680f25
                                                                                                        • Instruction Fuzzy Hash: 363102B0D01208EFDB50DF99C984BCEBFF5AB48314F248059E404BB794DB74A945CBA6
                                                                                                        Function 02D071D0 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 02D0724F
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4138894271.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_2d00000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CheckDebuggerPresentRemote
                                                                                                        • String ID:
                                                                                                        • API String ID: 3662101638-0
                                                                                                        • Opcode ID: 5edfdbc2b02ba27943fbe1b09dcb42f54bf5775ff49d7acd72e43aad751aa1b8
                                                                                                        • Instruction ID: 4f66df26943d12bd934b3e7c1e8a819ceb65f5ea2b1af17c23b399cd7a020100
                                                                                                        • Opcode Fuzzy Hash: 5edfdbc2b02ba27943fbe1b09dcb42f54bf5775ff49d7acd72e43aad751aa1b8
                                                                                                        • Instruction Fuzzy Hash: B32125B1800259CFDB10CFAAD484BEEBBF4AF49320F14846AE459A7351D738A944CF61
                                                                                                        Function 069C6B98 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 069C6C27
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DuplicateHandle
                                                                                                        • String ID:
                                                                                                        • API String ID: 3793708945-0
                                                                                                        • Opcode ID: 62b8edd65f393fc897c95c198c5b0c693a32c9656bc57b6b31ce5e36e125f5cf
                                                                                                        • Instruction ID: 20d39f1dd10136969113af8cce41a91438ffcfaf963c45fb7e5de0d3a6e60810
                                                                                                        • Opcode Fuzzy Hash: 62b8edd65f393fc897c95c198c5b0c693a32c9656bc57b6b31ce5e36e125f5cf
                                                                                                        • Instruction Fuzzy Hash: 7621E5B5900258DFDB10CFAAD985ADEBFF8EB48320F14841AE954A3310D378A940CFA5
                                                                                                        Function 069C6BA0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 069C6C27
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DuplicateHandle
                                                                                                        • String ID:
                                                                                                        • API String ID: 3793708945-0
                                                                                                        • Opcode ID: 58901af36c30ae6dc83e7ccf1f988b803400ae8aaa1acc1809d1b36f69d37481
                                                                                                        • Instruction ID: f0267e00efeacb761be906b2a6d12c5698ab877473ca5c07df70cc48eb17346c
                                                                                                        • Opcode Fuzzy Hash: 58901af36c30ae6dc83e7ccf1f988b803400ae8aaa1acc1809d1b36f69d37481
                                                                                                        • Instruction Fuzzy Hash: 6E21E4B5900208DFDB10CF9AD984ADEBFF8EB48320F14841AE914A3310C374A940CFA5
                                                                                                        Function 069CA166 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • SetWindowsHookExA.USER32(?,00000000,?,?), ref: 069CA1E3
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: HookWindows
                                                                                                        • String ID:
                                                                                                        • API String ID: 2559412058-0
                                                                                                        • Opcode ID: 6bab9f474c752c3ece9db01bce96a6a23a0444793222fcb932643895e0d2fae3
                                                                                                        • Instruction ID: 4f3faf5344e4a603af18ab8e4d16a6a07577713497b1bbd9497e0eabef2f4f56
                                                                                                        • Opcode Fuzzy Hash: 6bab9f474c752c3ece9db01bce96a6a23a0444793222fcb932643895e0d2fae3
                                                                                                        • Instruction Fuzzy Hash: 2421F4B5D002099FCB54DF9AD844BEEFBF5AB88320F10842AE459A7250C774A944CFA5
                                                                                                        Function 069CA168 Relevance: 1.6, APIs: 1, Instructions: 57COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • SetWindowsHookExA.USER32(?,00000000,?,?), ref: 069CA1E3
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: HookWindows
                                                                                                        • String ID:
                                                                                                        • API String ID: 2559412058-0
                                                                                                        • Opcode ID: 1202be0c36bbbd77da6e1136280a66691c398afd0877d17862b8f0405bb58272
                                                                                                        • Instruction ID: 31789a89c6391ab3edfa1032c9d8f3c8a4b8509b521ec204da8d29ad46582203
                                                                                                        • Opcode Fuzzy Hash: 1202be0c36bbbd77da6e1136280a66691c398afd0877d17862b8f0405bb58272
                                                                                                        • Instruction Fuzzy Hash: 6121F4B5D002099FCB54DF9AD844BEEFBF5AB88320F10842AE459A7250C774A944CFA5
                                                                                                        Function 02D0F3A0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GlobalMemoryStatusEx.KERNEL32 ref: 02D0F407
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4138894271.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_2d00000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: GlobalMemoryStatus
                                                                                                        • String ID:
                                                                                                        • API String ID: 1890195054-0
                                                                                                        • Opcode ID: 2a171487660a114ca92ee529f654fcabef16de1531361c9905a9ed9a4478c5c5
                                                                                                        • Instruction ID: 86fdab4762023c255308b7744c8449dc61e250f6134be80af397aaa9132dc75c
                                                                                                        • Opcode Fuzzy Hash: 2a171487660a114ca92ee529f654fcabef16de1531361c9905a9ed9a4478c5c5
                                                                                                        • Instruction Fuzzy Hash: 131112B1C006599FCB10CF9AD544BDEFBF4BB48320F20816AD818A7351D778A940CFA5
                                                                                                        Function 069C0424 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 069C1B16
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: HandleModule
                                                                                                        • String ID:
                                                                                                        • API String ID: 4139908857-0
                                                                                                        • Opcode ID: bd781fca6731d1a8cd0541a23396786985b03b9b722b57281625f4161227ec98
                                                                                                        • Instruction ID: d5356c17b7d15405abe2a6c18c15cfc6302e5cf6ec3aa7ffcdfec1dbbb64f665
                                                                                                        • Opcode Fuzzy Hash: bd781fca6731d1a8cd0541a23396786985b03b9b722b57281625f4161227ec98
                                                                                                        • Instruction Fuzzy Hash: F41132B5C003488FCB10CF9AC444BDEFBF4EB88220F10842AD819B7611D374A545CFA5
                                                                                                        Function 069C1AAB Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 069C1B16
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: HandleModule
                                                                                                        • String ID:
                                                                                                        • API String ID: 4139908857-0
                                                                                                        • Opcode ID: f2bb449716485bc1b51171c715bebbd2ac44c3ffc0c85f99717ac361f8fb7c02
                                                                                                        • Instruction ID: f2c349e65882a9d2437e09a012c69f64a94a08f55379e58e0a02c1ec7ebd0ec1
                                                                                                        • Opcode Fuzzy Hash: f2bb449716485bc1b51171c715bebbd2ac44c3ffc0c85f99717ac361f8fb7c02
                                                                                                        • Instruction Fuzzy Hash: 8B1132B6C007498FCB10CFAAC844ACEFBF8AB89220F10841AD469B7611D374A545CFA5
                                                                                                        Function 069C6764 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,069C7D45), ref: 069C7DCF
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CallbackDispatcherUser
                                                                                                        • String ID:
                                                                                                        • API String ID: 2492992576-0
                                                                                                        • Opcode ID: 6e1cb1606575adfc7c3d986514901d5af2cf28eeec2ec4b993ae13d93ae3bfb7
                                                                                                        • Instruction ID: f903e15b3f9c51d676d0a235fb17fe7507bb746454e63f71db05c2535fed5346
                                                                                                        • Opcode Fuzzy Hash: 6e1cb1606575adfc7c3d986514901d5af2cf28eeec2ec4b993ae13d93ae3bfb7
                                                                                                        • Instruction Fuzzy Hash: 051103B1800748CFDB60DF9AC489BEEFBF4EB48324F20845AD559A7650C375A944CFA5
                                                                                                        Function 069C693C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • OleInitialize.OLE32(00000000), ref: 069C868D
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Initialize
                                                                                                        • String ID:
                                                                                                        • API String ID: 2538663250-0
                                                                                                        • Opcode ID: 5962e23e86b97c993a0fb4c2176f519da4a87c28265916dcc5c4b82733899455
                                                                                                        • Instruction ID: 9ef23011b2da76f75415b9559bec90ba219d286ecba839e959732d597c292a52
                                                                                                        • Opcode Fuzzy Hash: 5962e23e86b97c993a0fb4c2176f519da4a87c28265916dcc5c4b82733899455
                                                                                                        • Instruction Fuzzy Hash: 681103B19007488FDB20DF9AD649BDEBFF4EB48324F208459D519A7610C375A944CFA5
                                                                                                        Function 069C8631 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • OleInitialize.OLE32(00000000), ref: 069C868D
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Initialize
                                                                                                        • String ID:
                                                                                                        • API String ID: 2538663250-0
                                                                                                        • Opcode ID: 6595f13211c4d5aea87dad0ba963b439abf2735d60e8b8758bd493f4de46058f
                                                                                                        • Instruction ID: 4f61e6959b6abf1f8551c3014224cef478b71cc7497e9a8d43994019c447484a
                                                                                                        • Opcode Fuzzy Hash: 6595f13211c4d5aea87dad0ba963b439abf2735d60e8b8758bd493f4de46058f
                                                                                                        • Instruction Fuzzy Hash: 771145B59003488FCB20DFAAD549BCEFFF8EB48320F20841AE559A3610C334A540CFA5
                                                                                                        Function 069C7D68 Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,069C7D45), ref: 069C7DCF
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143361828.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_69c0000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CallbackDispatcherUser
                                                                                                        • String ID:
                                                                                                        • API String ID: 2492992576-0
                                                                                                        • Opcode ID: 3f30cdd33048d23f46223ca7cea410d5f61ac44b6739e8656cee658198fec469
                                                                                                        • Instruction ID: fa8b8a4c79d178617468062ca826e0af8d6be96093c3e518ef0bbeeb4489d3ab
                                                                                                        • Opcode Fuzzy Hash: 3f30cdd33048d23f46223ca7cea410d5f61ac44b6739e8656cee658198fec469
                                                                                                        • Instruction Fuzzy Hash: 9B1112B1C00248CFDB20DF99D888BEEFBF4EB88324F20841AD559A7650C775A944CFA5
                                                                                                        Function 06A2DB6D Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: PH^q
                                                                                                        • API String ID: 0-2549759414
                                                                                                        • Opcode ID: 3562ca9e5c055053cbbbdede86c4dce9090ae898018ba83436027503166eba8f
                                                                                                        • Instruction ID: 25ca8659843ac0d17929dd825f7f60b5782bccabd4840293948e5db1d028a44f
                                                                                                        • Opcode Fuzzy Hash: 3562ca9e5c055053cbbbdede86c4dce9090ae898018ba83436027503166eba8f
                                                                                                        • Instruction Fuzzy Hash: 3941B270E4021A9FDB55FFB9C95469FBBB2BF85700F20452AD401EB241DBB0E846CB81
                                                                                                        Function 06A222A8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: PH^q
                                                                                                        • API String ID: 0-2549759414
                                                                                                        • Opcode ID: b2cc0ca0227e50dff7f2569ce3fb757df41f60c2e530bccd5bebf85969e4ef4d
                                                                                                        • Instruction ID: 8e408186ef6cee521a7f8470e2c6fc7789b37293551ec8f332c4efa48037a82b
                                                                                                        • Opcode Fuzzy Hash: b2cc0ca0227e50dff7f2569ce3fb757df41f60c2e530bccd5bebf85969e4ef4d
                                                                                                        • Instruction Fuzzy Hash: 5931CF30B502128FDB59AB78C5547AFBBE6BB89300F104928D406DB385EF35DD46CBA1
                                                                                                        Function 06A24B39 Relevance: 1.3, Strings: 1, Instructions: 25COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: \Ocq
                                                                                                        • API String ID: 0-2995510325
                                                                                                        • Opcode ID: eaa272b9605cfeecf3920ec041b2c32c4722d29089d6be08bf4663e1292ebb1f
                                                                                                        • Instruction ID: 67d76f912f5a31d7f214c29a59ef998942df8e23fdbb3799f946627cdb216659
                                                                                                        • Opcode Fuzzy Hash: eaa272b9605cfeecf3920ec041b2c32c4722d29089d6be08bf4663e1292ebb1f
                                                                                                        • Instruction Fuzzy Hash: 27F0DA30E5022ADBDB54EF98E8597AEBBB2FF88700F204519E402A7294CB701C05CFC0
                                                                                                        Function 06A22BC1 Relevance: .4, Instructions: 450COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 692262bdfa0179de641b8a16303a51ea56277d4c6d899ba571ea838022941606
                                                                                                        • Instruction ID: 7006d716f29b6207a1917ecc9719e9ba4fd9e782c28ef811b67c2b7f1f5aa702
                                                                                                        • Opcode Fuzzy Hash: 692262bdfa0179de641b8a16303a51ea56277d4c6d899ba571ea838022941606
                                                                                                        • Instruction Fuzzy Hash: 04026534A002258FCB64EB68C544A9DB7F2FF45310F55C4A9D80AAF365DB35ED85CB90
                                                                                                        Function 06A24318 Relevance: .3, Instructions: 287COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: f2ee8d7e213fa8c5b38414961f77c95c83dd84dcae2a56d133c6d311c79b6219
                                                                                                        • Instruction ID: 20581970f04d400334cd8c4b6121e8d32a64b5eb8bc2300d97470cd94e285bd9
                                                                                                        • Opcode Fuzzy Hash: f2ee8d7e213fa8c5b38414961f77c95c83dd84dcae2a56d133c6d311c79b6219
                                                                                                        • Instruction Fuzzy Hash: D6A19030B052668FDF45EF78C86069E7BF2EF8A300F144166D44ADF296DA34DC4687A1
                                                                                                        Function 06A262C0 Relevance: .2, Instructions: 229COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 4f538772640f4bdc16cb24c2c7ba5d3f7638a28eca12f94b74634b99629a0dae
                                                                                                        • Instruction ID: dc11a206fe5a076bfa29f68fd3d9efff5db04d18495cdc24634bd8aeb1d4f9e4
                                                                                                        • Opcode Fuzzy Hash: 4f538772640f4bdc16cb24c2c7ba5d3f7638a28eca12f94b74634b99629a0dae
                                                                                                        • Instruction Fuzzy Hash: DB61C171F411224FCB50AB7EC89466FEAD7AFC4620B25443AD80EDB360DE65DD0287C2
                                                                                                        Function 06A246A4 Relevance: .2, Instructions: 218COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: f2a61b0a2575676f2862c800b7c5170493b84f660c7e37cbc8fc93528fa687c1
                                                                                                        • Instruction ID: 12c19916e1fa294cb7df0cecbf8832deef96cc1760059bd2cf122a4b0e122c00
                                                                                                        • Opcode Fuzzy Hash: f2a61b0a2575676f2862c800b7c5170493b84f660c7e37cbc8fc93528fa687c1
                                                                                                        • Instruction Fuzzy Hash: 2A913D34E1061A8BDF60DF68C890B9DB7B1FF89300F208699D549AB355DB70A985CF91
                                                                                                        Function 06A246B8 Relevance: .2, Instructions: 210COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: fde6b5a4a1f9a3e76589540b25f539b4a9cc25a6daaf32be25bbb22be1a2115b
                                                                                                        • Instruction ID: 8c1123d9fe39310064da468ed686c66a741448232c85df3483d5e40f07c73441
                                                                                                        • Opcode Fuzzy Hash: fde6b5a4a1f9a3e76589540b25f539b4a9cc25a6daaf32be25bbb22be1a2115b
                                                                                                        • Instruction Fuzzy Hash: 65913D34E1061A8BDF60DF68C880B9DB7B1FF89300F208699D559AB355DB70AE85CF91
                                                                                                        Function 06A2EBB9 Relevance: .2, Instructions: 206COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: ec400788f548669d1c82b54857641781badb4540e2a79cd381d87806c17b9012
                                                                                                        • Instruction ID: bf7a41c5624ccc09aa6c5b8ea14ccdef92880327f3aaf63f88f862ffa1362df3
                                                                                                        • Opcode Fuzzy Hash: ec400788f548669d1c82b54857641781badb4540e2a79cd381d87806c17b9012
                                                                                                        • Instruction Fuzzy Hash: 57713E30A4121A9FDB55EFA9D980A9EBBF6FF88300F148569D409DB355DB30EC86CB50
                                                                                                        Function 06A2EBC8 Relevance: .2, Instructions: 201COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: db1f88e2003ac4583e0a99d8a3c7b62830bbe848498de01fb8d590fe5165978e
                                                                                                        • Instruction ID: 37faa23fbb48244ba76979104b2272c1372b37b96efe33da272bcab194078147
                                                                                                        • Opcode Fuzzy Hash: db1f88e2003ac4583e0a99d8a3c7b62830bbe848498de01fb8d590fe5165978e
                                                                                                        • Instruction Fuzzy Hash: 26711E30A402199FDB54EFA9D980A9EBBF6FF84300F148569D409DB355DB30EC86CB51
                                                                                                        Function 06A2FD20 Relevance: .2, Instructions: 181COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 2c8b23782ac3b4f90a7bf6bd4d96a20d882def931d60ceb8ae25b93c83cc76ab
                                                                                                        • Instruction ID: fc518de79beaf42a6715a6d43af7593607ecbe0dfd91574ebe106f98b9dac594
                                                                                                        • Opcode Fuzzy Hash: 2c8b23782ac3b4f90a7bf6bd4d96a20d882def931d60ceb8ae25b93c83cc76ab
                                                                                                        • Instruction Fuzzy Hash: EF51D131E81116DFDF64EB7CE9446AEBBB2EF85314F108869E50ADB250DB319C55CB80
                                                                                                        Function 06A2FAD3 Relevance: .2, Instructions: 168COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: a9eec72817d0036430d203eea924e2b51aa43cc155d8e5ad5c5b09055a1caf78
                                                                                                        • Instruction ID: 8f86105402fac67fbd500a69084900ea2e22e3f67e33e9f4e74bf7e85d149bd2
                                                                                                        • Opcode Fuzzy Hash: a9eec72817d0036430d203eea924e2b51aa43cc155d8e5ad5c5b09055a1caf78
                                                                                                        • Instruction Fuzzy Hash: CE511A30B903258FEF64677CD99072F267BD789750F20492AE40ADB3E5C939CC4587A2
                                                                                                        Function 06A2FAE0 Relevance: .2, Instructions: 163COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 44210bd6385e23a544bad5cefc62faff24aaacbd1f011abe22b8199647c44656
                                                                                                        • Instruction ID: 0e46f0a8b3f04a6f266716212c29369f85285023df940b3fe6a54b3ccb3cbc02
                                                                                                        • Opcode Fuzzy Hash: 44210bd6385e23a544bad5cefc62faff24aaacbd1f011abe22b8199647c44656
                                                                                                        • Instruction Fuzzy Hash: D7512930B903298FEF60776CD99072F266FD789750F20492AE40ADB3E5CA39CC4547A2
                                                                                                        Function 06A22158 Relevance: .1, Instructions: 95COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: bc52ecea605ac04547c79b9f6830f7f7886295fd9995e5baf8f4759764b66226
                                                                                                        • Instruction ID: f31548268e20976973ea7655e2b616c7af2360d56d777bba4305026ed240cd68
                                                                                                        • Opcode Fuzzy Hash: bc52ecea605ac04547c79b9f6830f7f7886295fd9995e5baf8f4759764b66226
                                                                                                        • Instruction Fuzzy Hash: F2317030E102169BCB55DFA9D894A9EB7F2FF89300F108529E816EB750DB71ED42CB51
                                                                                                        Function 06A22168 Relevance: .1, Instructions: 91COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: a919af3fbe0bbeede3361b01d60a58e59e9b0ce34dec40f72dbaab9061e6e8ad
                                                                                                        • Instruction ID: ceb398b747cf1ed119d5be2a3922a1865988c191ac60c7d55779d544a050563d
                                                                                                        • Opcode Fuzzy Hash: a919af3fbe0bbeede3361b01d60a58e59e9b0ce34dec40f72dbaab9061e6e8ad
                                                                                                        • Instruction Fuzzy Hash: A9318030E102169BCF59DFA9D894A9EB7B2FF89300F108519E816EB750DB71ED46CB60
                                                                                                        Function 06A2A3DA Relevance: .1, Instructions: 89COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: ee6dc6905ed63c92ac825d82af0c08f2d9fa5e67f4fbb850d25c69506645ff5b
                                                                                                        • Instruction ID: 0407b1ec8fea7e498f76ab0fce0cd6f3a64738e5baa774b8b8e9b81dde75d2ca
                                                                                                        • Opcode Fuzzy Hash: ee6dc6905ed63c92ac825d82af0c08f2d9fa5e67f4fbb850d25c69506645ff5b
                                                                                                        • Instruction Fuzzy Hash: D221D035B501225FDB50EB3CE8507AEB3E6EB45710F10897AE20ECB381EB20DC068791
                                                                                                        Function 06A23B89 Relevance: .1, Instructions: 84COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: dd70e9756edd88b01a728f02d14fb2ec50eb04eb1d8efd1be27e5c4e6119bf0d
                                                                                                        • Instruction ID: 865069a4a1e7709c3e9687f31482aa956f46572ca0d605ce7ffa68cf8eb0086c
                                                                                                        • Opcode Fuzzy Hash: dd70e9756edd88b01a728f02d14fb2ec50eb04eb1d8efd1be27e5c4e6119bf0d
                                                                                                        • Instruction Fuzzy Hash: 08217C75F512269FDF41EF69D840BAEBBF6AB48710F108069E905E7382E734E9018B91
                                                                                                        Function 06A23B98 Relevance: .1, Instructions: 78COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: cdac5e62d3a84006b9a5ce421592de6159aeb0fa6edfb5b45bf74a8b7f96eb6d
                                                                                                        • Instruction ID: 59b7f5189d1c4cdcfb30175d77a18713e811888f52f3391123958c00c0835101
                                                                                                        • Opcode Fuzzy Hash: cdac5e62d3a84006b9a5ce421592de6159aeb0fa6edfb5b45bf74a8b7f96eb6d
                                                                                                        • Instruction Fuzzy Hash: DA217C75F512269FDF40EF69D880AAEBBF1FB48710F108129E905E7341E734E9018B91
                                                                                                        Function 02C3D030 Relevance: .1, Instructions: 72COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4138638566.0000000002C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C3D000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_2c3d000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 53db7b087db1c68e9f662246d417b8e478d62e66f8d61a71f4873d509763c5ba
                                                                                                        • Instruction ID: 0799dbe11328771e1149d75c1fd9c0b992f90b1c6c5bad85d2d8a25bfb560f15
                                                                                                        • Opcode Fuzzy Hash: 53db7b087db1c68e9f662246d417b8e478d62e66f8d61a71f4873d509763c5ba
                                                                                                        • Instruction Fuzzy Hash: 0A212671504304DFDB16DF14DAC0B26BBA5FB84714F24C96DE80B4B256C37AD447CAA2
                                                                                                        Function 02C3D005 Relevance: .1, Instructions: 68COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4138638566.0000000002C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C3D000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_2c3d000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 6d8b8f7682266fc374f8dd208cb2df746ea35e1ae8615a452048688a486aba6c
                                                                                                        • Instruction ID: f24730845d532c712d299382b889395914d360cc56c774f19ffa0381c550567a
                                                                                                        • Opcode Fuzzy Hash: 6d8b8f7682266fc374f8dd208cb2df746ea35e1ae8615a452048688a486aba6c
                                                                                                        • Instruction Fuzzy Hash: 64212A7550D3C08FDB13CB24D990715BF71AB86214F29C5DBD8898F6A7C33A984ACB62
                                                                                                        Function 06A23CA8 Relevance: .1, Instructions: 59COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 4ec8c9364ef4e668750408d238830f52279afa776b79fd2dffd27f521ef2bccd
                                                                                                        • Instruction ID: 42eada21ebc22792ab3e59ca67e36dd06b96f7eada992ba75679f9e0e9b4375d
                                                                                                        • Opcode Fuzzy Hash: 4ec8c9364ef4e668750408d238830f52279afa776b79fd2dffd27f521ef2bccd
                                                                                                        • Instruction Fuzzy Hash: CD118E32B101255FDF94A679C814AAE73EAABC9710B00493AD50AEB344DF259C028BE1
                                                                                                        Function 06A2EE38 Relevance: .1, Instructions: 56COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 968454560c923d2a0d37566e090119a34453f563523fbae7712743eba3212016
                                                                                                        • Instruction ID: 18b6373438c647775def7afb98e8c2b59185d09a140acca7bc5b0e4ddf9ed438
                                                                                                        • Opcode Fuzzy Hash: 968454560c923d2a0d37566e090119a34453f563523fbae7712743eba3212016
                                                                                                        • Instruction Fuzzy Hash: B9018431B541212BDB61A62EA854B2F67DBEBCBA10F148C3AE10ACB340DE65DC464395
                                                                                                        Function 06A23C99 Relevance: .1, Instructions: 56COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 42412fcbf9f7c3f0cea9a03e955dc59f3aaef25a00eb38582932e3c8aeb91a07
                                                                                                        • Instruction ID: 920c3b62a36b861d995daaa74b2404c871a09e979d09526b671437ed5bf05027
                                                                                                        • Opcode Fuzzy Hash: 42412fcbf9f7c3f0cea9a03e955dc59f3aaef25a00eb38582932e3c8aeb91a07
                                                                                                        • Instruction Fuzzy Hash: 9901D432B240262BDF95A6799C10AEF77EF9BC9710F10453AE50AD7385DF64980347E2
                                                                                                        Function 06A23EDF Relevance: .1, Instructions: 54COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 413ac368c4df30ef90fe219a2261d73a77ed6cd6fad2c3ff8c67aca917e3e8f8
                                                                                                        • Instruction ID: 372a987622dad3c496b614c1ad2868febc7a84aa55e5021661baa8af08da764c
                                                                                                        • Opcode Fuzzy Hash: 413ac368c4df30ef90fe219a2261d73a77ed6cd6fad2c3ff8c67aca917e3e8f8
                                                                                                        • Instruction Fuzzy Hash: 0901BC30B400215FDF60AA6DA81476BB3E6DBCA611F14883EE51ECB780EA69CC024395
                                                                                                        Function 06A23961 Relevance: .1, Instructions: 54COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 38214d98c97731bfc708c6e603ce1625b2ed6e07cced718736dbb8875afe9bcf
                                                                                                        • Instruction ID: 1277434ffe8eb2cc850c5b453ef60ca436d2b26765fe0ff70ce93b64e17d3e44
                                                                                                        • Opcode Fuzzy Hash: 38214d98c97731bfc708c6e603ce1625b2ed6e07cced718736dbb8875afe9bcf
                                                                                                        • Instruction Fuzzy Hash: 5721F2B1D01259EFCB10DF9AD885ADEFFB4BB49314F10812AE518A7200C378A550CFA5
                                                                                                        Function 06A2C880 Relevance: .1, Instructions: 52COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 0e697b3dc983462b2c51f54e9821533f150bac675e7e3cb6ecaab38042956ab8
                                                                                                        • Instruction ID: c5fec1be016ab37a51527770d9698eaf59c359ec241aa1de4605f498bf3c3a9b
                                                                                                        • Opcode Fuzzy Hash: 0e697b3dc983462b2c51f54e9821533f150bac675e7e3cb6ecaab38042956ab8
                                                                                                        • Instruction Fuzzy Hash: 6001FC31A512356BCF64AA79EC41BDF7776F785320F004539E506DB385DB31980587D0
                                                                                                        Function 06A23968 Relevance: .1, Instructions: 52COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 28355dbda99891f9960f068dd1938cbb470cc93a6e1b75e4626587d81cbc38ae
                                                                                                        • Instruction ID: d15b935c872bc59a02af50c72ae8ab5f004f0a725a74579f320af62ab28fc82b
                                                                                                        • Opcode Fuzzy Hash: 28355dbda99891f9960f068dd1938cbb470cc93a6e1b75e4626587d81cbc38ae
                                                                                                        • Instruction Fuzzy Hash: 5B11D0B1D01219EFCB10DF9AD885ADEFBB4FB49324F10812AE918A7200C374A954CFA5
                                                                                                        Function 06A23EF0 Relevance: .1, Instructions: 51COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 183b10d3c53da5ebb307d5991a488bbc5c59ba75e6df7d2114cf74e3e773f656
                                                                                                        • Instruction ID: 40b5000530efa7f7185e8e6540638012c01d68d7f50cbf1c16747bb77e9f8b66
                                                                                                        • Opcode Fuzzy Hash: 183b10d3c53da5ebb307d5991a488bbc5c59ba75e6df7d2114cf74e3e773f656
                                                                                                        • Instruction Fuzzy Hash: 6A018131B100221BDF64A66EA454B2FB3EADBCAB14F10883DE51ECB744EE69DC024395
                                                                                                        Function 06A2EE48 Relevance: .0, Instructions: 49COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 9ef6d60923be8fd1e2925a7896fa22588c3a296c962df58bf7d0d47f6d0cc5e1
                                                                                                        • Instruction ID: b3435e718cca00aae406ee36a7526a1c3b7feb9e8f46b97f4e231a8559cc14fe
                                                                                                        • Opcode Fuzzy Hash: 9ef6d60923be8fd1e2925a7896fa22588c3a296c962df58bf7d0d47f6d0cc5e1
                                                                                                        • Instruction Fuzzy Hash: A501AF31F500222BDB65A67EA454B2F73DAEBCBA10F148C39E10ECB344EE25DC824385
                                                                                                        Function 06A2A3E8 Relevance: .0, Instructions: 46COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 2b0d53cffb16bed2bafbb142094ddbe7d22fe4baf3d090d087bb854f22d81a34
                                                                                                        • Instruction ID: 6dd40b861ec413201994adcbfb8220c71aa455359cdb2e355d8e6ae69d5a5755
                                                                                                        • Opcode Fuzzy Hash: 2b0d53cffb16bed2bafbb142094ddbe7d22fe4baf3d090d087bb854f22d81a34
                                                                                                        • Instruction Fuzzy Hash: 38018130B604225BDB60EB3DE45472F73D6EB89710F108839E20ECB744EE21DC028781
                                                                                                        Function 06A26549 Relevance: .0, Instructions: 30COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 29431bea2890683f93d65d9fdcd735b7318598106156b8e5c6bceeb5108ed91d
                                                                                                        • Instruction ID: 66af96345e4a4d6ee5e870c4f17503e3af5207ee39b8a95d16a359f62e865d08
                                                                                                        • Opcode Fuzzy Hash: 29431bea2890683f93d65d9fdcd735b7318598106156b8e5c6bceeb5108ed91d
                                                                                                        • Instruction Fuzzy Hash: 1FE02230D4A1259FDF10EB788A003DA37B9EB03240F3149AAD009DF142D236CE068760

                                                                                                        Non-executed Functions

                                                                                                        Function 06A27770 Relevance: 13.0, Strings: 10, Instructions: 468COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                                        • API String ID: 0-2222239885
                                                                                                        • Opcode ID: 20cf5c3a86152ec49a7ba1ec71bcc8dfa271a3ff94dddc4e2aa3f02b55347798
                                                                                                        • Instruction ID: 906a9a1367a3dc03f7df5eba1c16952ee69640e80097722701909b0cee4c68b4
                                                                                                        • Opcode Fuzzy Hash: 20cf5c3a86152ec49a7ba1ec71bcc8dfa271a3ff94dddc4e2aa3f02b55347798
                                                                                                        • Instruction Fuzzy Hash: AA121C30E4022A8FDB64EF69C954AAEB7F2BF84700F208569D409AB355DB31DD85CF91
                                                                                                        Function 06A2AA08 Relevance: 10.2, Strings: 8, Instructions: 229COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                                        • API String ID: 0-3823777903
                                                                                                        • Opcode ID: a7f0635cb5e0d893e9f1de8c2d4ec905a43bb892fefeeda2e15f277eac8cbaaa
                                                                                                        • Instruction ID: 4a122a9a6fa5f079a540960cf22a6bd0bd4ffe80cff7b4a1d18e865ea9c8a38a
                                                                                                        • Opcode Fuzzy Hash: a7f0635cb5e0d893e9f1de8c2d4ec905a43bb892fefeeda2e15f277eac8cbaaa
                                                                                                        • Instruction Fuzzy Hash: 06916C30E8022A9FDB68EF69D584BAEB7F2FF44701F108529D5019B395DB349C45CB90
                                                                                                        Function 06A27170 Relevance: 9.2, Strings: 7, Instructions: 405COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                                        • API String ID: 0-390881366
                                                                                                        • Opcode ID: 895873a1a3e70c3a83bc6692becd907b839de4bce35633d2247fc62b699d7127
                                                                                                        • Instruction ID: 78fc615dba6f9a53a344bb5f240c63735341c26948e3f1bc4874f21fe539030f
                                                                                                        • Opcode Fuzzy Hash: 895873a1a3e70c3a83bc6692becd907b839de4bce35633d2247fc62b699d7127
                                                                                                        • Instruction Fuzzy Hash: F8F15C30A40219CFDB59EF69C594B6EB7B2FF84300F208569D4059B3A9DB31ED82CB91
                                                                                                        Function 06A284A8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $^q$$^q$$^q$$^q
                                                                                                        • API String ID: 0-2125118731
                                                                                                        • Opcode ID: 3cfa7330f22271b88f1cf06dcabadd26a4d97deb279b3ed9778248d672fa6d8f
                                                                                                        • Instruction ID: e3551e87ef021c7cf09e6ba076f1dfa2ba75d29dc9f4729f23df4fe46680ff99
                                                                                                        • Opcode Fuzzy Hash: 3cfa7330f22271b88f1cf06dcabadd26a4d97deb279b3ed9778248d672fa6d8f
                                                                                                        • Instruction Fuzzy Hash: D3B12C30E502198FDB54EB69D5847AEB7B2FF84300F24C529E4069B395DB35DC86CB91
                                                                                                        Function 06A288C0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: LR^q$LR^q$$^q$$^q
                                                                                                        • API String ID: 0-2454687669
                                                                                                        • Opcode ID: fb6974c4ddb979e5c5234f974d3dce6b5e1f88486186716ed62579bcc30e6289
                                                                                                        • Instruction ID: a2109d3f11e0a258cdfea9809be322d356b3949c2ea7b012fe058f6e015731d2
                                                                                                        • Opcode Fuzzy Hash: fb6974c4ddb979e5c5234f974d3dce6b5e1f88486186716ed62579bcc30e6289
                                                                                                        • Instruction Fuzzy Hash: 4251D530B502168FDB54EB29C980A6E77F6FF89300F108668E4059F3A9DB34EC49CB91
                                                                                                        Function 06A2AD90 Relevance: 5.2, Strings: 4, Instructions: 166COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000004.00000002.4143586158.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_4_2_6a20000_Quote GVSE24-00815.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $^q$$^q$$^q$$^q
                                                                                                        • API String ID: 0-2125118731
                                                                                                        • Opcode ID: 9902f2d6410a7131d407e26115f3a3a5c3d450b0b8f4b7b3d0acd0562579eed6
                                                                                                        • Instruction ID: e55205281de34f3d2232492e222f0cf2587a201256d0ca3a4eb410fc6b9148e7
                                                                                                        • Opcode Fuzzy Hash: 9902f2d6410a7131d407e26115f3a3a5c3d450b0b8f4b7b3d0acd0562579eed6
                                                                                                        • Instruction Fuzzy Hash: 5651BF30E502269FCF65EB28D580BAEB3B2EF89300F108629E506DB355DB34DC42CB91