Edit tour

Windows Analysis Report
QUOTATION_MARQUOTE312025#U00faPDF.scr

Overview

General Information

Sample name:	QUOTATION_MARQUOTE312025#U00faPDF.scr renamed because original name is a hash value
Original sample name:	QUOTATION_MARQUOTE312025PDF.scr
Analysis ID:	1637189
MD5:	13ba19e0b6739fc60f03922aed943dc9
SHA1:	4d7b9cb1ebe9c068313e34653301a96a8ea33de3
SHA256:	81ff89ae24ade11b7adca19d9fc34b31b1b77caf3125ad8dbb40a47fb0f62b53
Infos:

Detection

MSIL Logger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected MSIL Logger

Yara detected Telegram RAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs new ROOT certificates

Joe Sandbox ML detected suspicious sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w7x64

QUOTATION_MARQUOTE312025#U00faPDF.scr (PID: 3424 cmdline: "C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr" /S MD5: 13BA19E0B6739FC60F03922AED943DC9)

QUOTATION_MARQUOTE312025#U00faPDF.scr (PID: 3704 cmdline: "C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr" MD5: 13BA19E0B6739FC60F03922AED943DC9)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.478478560.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.476666794.0000000003241000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.476666794.0000000003241000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000002.00000002.626748654.00000000000F2000.00000020.00000400.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000000.00000002.476666794.00000000031B7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000002.00000002.627060723.0000000002237000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.473407134.00000000021A7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.627060723.0000000002121000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3424	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3424	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3704	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3704	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3704	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.32dc29e.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.5fb0000.16.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.32dc29e.4.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.5fb0000.16.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
2.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.f0000.0.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.335ba90.6.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.329c27e.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.335ba90.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr, QueryName: checkip.dyndns.org

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T11:54:44.231996+0100	2803274	2	Potentially Bad Traffic	192.168.2.22	49163	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.22:49164 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 198.16.88.194:443 -> 192.168.2.22:49162 version: TLS 1.2

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478120535.0000000005030000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003141000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478120535.0000000005030000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003141000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478070470.0000000004D90000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478070470.0000000004D90000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 4x nop then jmp 042A9457h	0_2_042A92D3
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 4x nop then jmp 042A3D89h	0_2_042A3B49
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 4x nop then jmp 042A3D89h	0_2_042A3B58
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 4x nop then jmp 042A344Ah	0_2_042A33C8
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_0528DDD8
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 4x nop then jmp 0031E489h	2_2_0031DDFA
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 4x nop then jmp 0031E489h	2_2_0031DE3E
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_005162A0

Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=YmcBf_yCowIJ_-0OSJ2J32Pq63RhMjfKVYVyiQ7wAVRg61cKgsdlHLacog&pk_vid=7138c067f80045c41741845350c1eb95 HTTP/1.1Host: 2015.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=YmcBf_yCowIJ_-0OSJ2J32Pq63RhMjfKVYVyiQ7wAVRg61cKgsdlHLacog&pk_vid=7138c067f80045c41741845350c1eb95 HTTP/1.1Host: 2015.filemail.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 198.16.88.194 198.16.88.194
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49163 -> 193.122.130.0:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.22:49164 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=YmcBf_yCowIJ_-0OSJ2J32Pq63RhMjfKVYVyiQ7wAVRg61cKgsdlHLacog&pk_vid=7138c067f80045c41741845350c1eb95 HTTP/1.1Host: 2015.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=YmcBf_yCowIJ_-0OSJ2J32Pq63RhMjfKVYVyiQ7wAVRg61cKgsdlHLacog&pk_vid=7138c067f80045c41741845350c1eb95 HTTP/1.1Host: 2015.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: 2015.filemail.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473407134.00000000020E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2015.filemail.com
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr	String found in binary or memory: http://2015.filemail.com/api/file/get?filekey=YmcBf_yCowIJ_-0OSJ2J32Pq63RhMjfKVYVyiQ7wAVRg61cKgsdlHL
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.00000000021AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.00000000021AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comX
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.0000000002121000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.00000000021AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.0000000002121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.00000000021AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/X
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.00000000021AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgX
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.0000000000727000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.0000000000727000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.00000000021CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.00000000021CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgX
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473407134.00000000020E1000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.0000000002121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473407134.000000000210D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2015.filemail.com
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473407134.000000000210D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2015.filemail.com/api/file/get?filekey=YmcBf_yCowIJ_-0OSJ2J32Pq63RhMjfKVYVyiQ7wAVRg61cKgsdlH
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.0000000002121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478070470.0000000004D90000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478070470.0000000004D90000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478070470.0000000004D90000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.00000000021AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.00000000021AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.00000000021AE000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.626903540.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627060723.00000000021AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189X
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.627336429.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478070470.0000000004D90000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478070470.0000000004D90000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473407134.00000000021A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478070470.0000000004D90000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162

Source: unknown

HTTPS traffic detected: 198.16.88.194:443 -> 192.168.2.22:49162 version: TLS 1.2

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: QUOTATION_MARQUOTE312025#U00faPDF.scr

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Memory allocated: 770B0000 page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Memory allocated: 770B0000 page execute and read and write			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04317FF8 NtResumeThread,		0_2_04317FF8
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04317FF0 NtResumeThread,		0_2_04317FF0

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0034CD08	0_2_0034CD08
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_003434B7	0_2_003434B7
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_00341BDF	0_2_00341BDF
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0034C378	0_2_0034C378
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_003418DB	0_2_003418DB
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_00341961	0_2_00341961
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_00341C36	0_2_00341C36
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_01E92F28	0_2_01E92F28
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04125C2A	0_2_04125C2A
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0412DCB0	0_2_0412DCB0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0412CF80	0_2_0412CF80
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0412B0E8	0_2_0412B0E8
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04123AEA	0_2_04123AEA
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04124410	0_2_04124410
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04124400	0_2_04124400
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0412DCA1	0_2_0412DCA1
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_041233C0	0_2_041233C0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04158C70	0_2_04158C70
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04153860	0_2_04153860
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0415649B	0_2_0415649B
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04154B29	0_2_04154B29
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04150006	0_2_04150006
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04153850	0_2_04153850
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04150040	0_2_04150040
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04158CB9	0_2_04158CB9
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04158CC8	0_2_04158CC8
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0415BE20	0_2_0415BE20
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0415AAD8	0_2_0415AAD8
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0415AAC9	0_2_0415AAC9
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_042A0040	0_2_042A0040
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_042A51D0	0_2_042A51D0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_042A51C6	0_2_042A51C6
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_042A7228	0_2_042A7228
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_042A7219	0_2_042A7219
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_042C0040	0_2_042C0040
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_042C3A50	0_2_042C3A50
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_042C1248	0_2_042C1248
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_042C0367	0_2_042C0367
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04310B18	0_2_04310B18
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04310C96	0_2_04310C96
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04315131	0_2_04315131
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_043145BF	0_2_043145BF
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04310B08	0_2_04310B08
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04311F92	0_2_04311F92
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04316398	0_2_04316398
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D2E7C8	0_2_04D2E7C8
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D20040	0_2_04D20040
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D27D90	0_2_04D27D90
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D27DA0	0_2_04D27DA0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D2C6D3	0_2_04D2C6D3
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D2C6E0	0_2_04D2C6E0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D29A68	0_2_04D29A68
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D273A0	0_2_04D273A0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D25B45	0_2_04D25B45
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D29318	0_2_04D29318
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D29308	0_2_04D29308
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0528F578	0_2_0528F578
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_05280040	0_2_05280040
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_05E6F8C0	0_2_05E6F8C0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_05E50040	0_2_05E50040
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_05E50019	0_2_05E50019
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_05E6E310	0_2_05E6E310
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_0031AA70	2_2_0031AA70
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00313A60	2_2_00313A60
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_0031C3D0	2_2_0031C3D0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_0031BCA0	2_2_0031BCA0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00312DED	2_2_00312DED
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_0031C030	2_2_0031C030
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_0031D0E8	2_2_0031D0E8
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00319928	2_2_00319928
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_0031AA60	2_2_0031AA60
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00313A50	2_2_00313A50
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_003142F0	2_2_003142F0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_003137A8	2_2_003137A8
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00313798	2_2_00313798
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00318FD7	2_2_00318FD7
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_005060C1	2_2_005060C1
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_0050C858	2_2_0050C858
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_005070D8	2_2_005070D8
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00507C88	2_2_00507C88
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_005020BE	2_2_005020BE
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_005034A9	2_2_005034A9
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_005061CA	2_2_005061CA
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_005025E4	2_2_005025E4
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_0050365D	2_2_0050365D
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00501A45	2_2_00501A45
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00506615	2_2_00506615
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00506E3F	2_2_00506E3F
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00501F11	2_2_00501F11
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_005162A0	2_2_005162A0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_0051A008	2_2_0051A008
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00515421	2_2_00515421
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_005170F0	2_2_005170F0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00517955	2_2_00517955
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00517100	2_2_00517100
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_005161E3	2_2_005161E3
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00515D88	2_2_00515D88
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00515E08	2_2_00515E08
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00516290	2_2_00516290
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00510BC3	2_2_00510BC3
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_0051B79A	2_2_0051B79A
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00770014	2_2_00770014
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_007754B0	2_2_007754B0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_007754A0	2_2_007754A0
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_007776B6	2_2_007776B6
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_007776B8	2_2_007776B8
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_00774AAF	2_2_00774AAF
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 2_2_0077671A	2_2_0077671A

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473407134.0000000002734000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478070470.0000000004D90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000000.355807967.0000000000463000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOhvfxjialif.exe> vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478356891.0000000005D20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSlnviws.dll" vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473314744.0000000000674000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478120535.0000000005030000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473407134.000000000210D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSlnviws.dll" vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.00000000031B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473407134.00000000021A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.626903540.0000000000554000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000002.00000002.626775980.000000000013A000.00000002.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs QUOTATION_MARQUOTE312025#U00faPDF.scr
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr	Binary or memory string: OriginalFilenameOhvfxjialif.exe> vs QUOTATION_MARQUOTE312025#U00faPDF.scr

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, SimpleSubscriber.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, ry2y1e0rYXj2S9Ae1lO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, ry2y1e0rYXj2S9Ae1lO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, QLB6gt9947mnOV3RnGD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, UFJwYskR7Ktwc6SIEZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.34fc620.8.raw.unpack, GtGJcVysHAcgDS7Ipn9.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.34fc620.8.raw.unpack, GtGJcVysHAcgDS7Ipn9.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.34fc620.8.raw.unpack, GtGJcVysHAcgDS7Ipn9.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.34fc620.8.raw.unpack, GtGJcVysHAcgDS7Ipn9.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.30f14f0.5.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.30f14f0.5.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.30f14f0.5.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.30f14f0.5.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.30f14f0.5.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.30f14f0.5.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.30f14f0.5.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.30f14f0.5.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winSCR@3/0@7/3

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

Mutant created: NULL

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr "C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr" /S
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process created: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr "C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr"
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process created: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr "C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478120535.0000000005030000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003141000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478120535.0000000005030000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003141000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478070470.0000000004D90000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.478070470.0000000004D90000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.476666794.0000000003445000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, ry2y1e0rYXj2S9Ae1lO.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.34fc620.8.raw.unpack, GtGJcVysHAcgDS7Ipn9.cs	.Net Code: Type.GetTypeFromHandle(x6P8onQpbI425ng7Iy3.JSvK26TqsK(16777356)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(x6P8onQpbI425ng7Iy3.JSvK26TqsK(16777255)),Type.GetTypeFromHandle(x6P8onQpbI425ng7Iy3.JSvK26TqsK(16777285))})

.NET source code contains potential unpacker

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, ActiveOrder.cs	.Net Code: HandleScalableOrder System.AppDomain.Load(byte[])
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.3141510.7.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.30f14f0.5.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.30f14f0.5.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.30f14f0.5.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.32dc29e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.5fb0000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.32dc29e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.5fb0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.335ba90.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.329c27e.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.335ba90.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.478478560.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.476666794.000000000335B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.476666794.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.473407134.00000000021A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3424, type: MEMORYSTR

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_01E952B4 pushad ; retf	0_2_01E952C1
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_01E936AC push 0C057F4Ch; ret	0_2_01E936BD
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04125524 push ebp; retf	0_2_04125526
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_0415178C pushad ; iretd	0_2_0415178D
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_042A9FEC pushfd ; retf 005Ah	0_2_042A9FED
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Code function: 0_2_04D23DE6 push ebp; ret	0_2_04D23DE7

Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, ry2y1e0rYXj2S9Ae1lO.cs	High entropy of concatenated method names: 'QrewvnOMoCXgHZnOfBL', 'H8jKZAOWHEnLUWSwvn7', 'T29R8VUJMe', 'vh0ry9Sq2v', 'a7DRFRXo5K', 'IS4RgtAAZ9', 'sRoRhh1QxT', 'gshR2dlCuG', 'Mt8F3DpRu6', 'j150PxJU58'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, KaJDVY21VyRMRm4AJy.cs	High entropy of concatenated method names: 'GAv4HCrM6', 'OkHLiW9v8', 'Equals', 'GetHashCode', 'nMLbPcEZG', 'ToString', 'h3qMeoIpIX43wkmuuuZ', 'USjVhxIiqPFAsHyEQAH', 'Equals', 'GetHashCode'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, tEn5vCRwe8SvqlFSrFh.cs	High entropy of concatenated method names: 'nueRGyE7qZ', 'WawRfMJ5am', 'uQfRXeV5Ia', 'VOvRjvH4uK', 'OjQRMvIfvW', 'a2nRW6ffiK', 'LeMR7nn3SQ', 'C6gR5hLLfY', 'bqyR3QcQB1', 'ovSRyUk472'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, QLB6gt9947mnOV3RnGD.cs	High entropy of concatenated method names: 'DslxTP7eng', 'z0Lx9kmpXr', 'bKfxcSbSDn', 'RT5xR1p4RK', 'lNHxJpmYNK', 'ssPxO51WyF', 'I2N9GEJje1b6Hp21hMk', 'YS5RNVJMx8ahRiNuLaE', 'sgp98uXPcG', 'nEP90kR7Lu'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, UFJwYskR7Ktwc6SIEZ.cs	High entropy of concatenated method names: 'cUuTtRZSQh', 'hLMTmgX4jw', 'zPg7EDJhClp7QM5KjE7', 'DXauFBJ2JRQMYBaW1Ow', 'NAoTVfqQop', 'MLyTrbRg8P', 'lrrTLd3vvB', 'fIXTfGOCCm', 'LT3TXxKbEq', 'fXnTM1cert'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, MozilSpeed.cs	High entropy of concatenated method names: 'tqnxkGN03d', 'Lg3xuEVpPg', 'o9IxDaISA2', 'cTLxBIx7YK', 'AtcxzKidiZ', 'Vm78nYtxxq', 'dClIgZOIZNyAEiwZXpp', 'miaiYLOJMlcK6HKuSHE', 'AyC8cpZFCQ', 'Wc98R3q0qq'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.34fc620.8.raw.unpack, GtGJcVysHAcgDS7Ipn9.cs	High entropy of concatenated method names: 'eVDwBEEl6E68uwQvMOI', 'fVF2MNEdQOMmBtsoUIO', 'aJEQt2hHxc', 'vh0ry9Sq2v', 'bUpQkjnUjH', 'IDiQeZogtD', 'spIQ3Soj9C', 'ldXQwUikrs', 'oABKVXhZLZ', 'AVWy1jHOyv'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.34fc620.8.raw.unpack, sLggdY2ZGUwNj0SqWcW.cs	High entropy of concatenated method names: 'RmjS3pe4dA', 'V3ISwKMIdE', 'SMvSDWNMTV', 'oitYSFbiJZOYueuTKaP', 'vvA8Xcb8HWJTbVirhQE', 'qdL2RuwDDv', 'zVw2AEWJYv', 'mYO2Gf85M1', 'BLv2z98Ntg', 'wMbSn1NC1I'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.34fc620.8.raw.unpack, estXs7QcysUifyngKSm.cs	High entropy of concatenated method names: 'WxCQxG0jhr', 'ClKQbxrT9P', 'bQPQE8Vvtg', 'e72Quw30j5', 'zavQqah1q0', 'vBuQKxFMHO', 'NnEQLksqce', 'VjbQZLsGET', 'oSHQXJrKKS', 'LddQRaY8kJ'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.34fc620.8.raw.unpack, sPALwASxMCLw1KpM57C.cs	High entropy of concatenated method names: 'b3jSKOQPS0', 'v7TSL16ZyR', 'N6xSZWNLXI', 'G1KSX9oKsP', 'ulmSR22JRv', 'lLTSAvnJMi', 'paPSG2qRpU', 'CfOSzM2DM8', 'xKuyng6S3l', 'QYOyr8xD7j'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.34fc620.8.raw.unpack, CljXSsQAkMU7ih7IXFh.cs	High entropy of concatenated method names: 'QMQ4GTmMoy', 'yM14zgPTon', 'vQVNnjWqyu', 'tnRNr6e2b3', 'FTaNopJ721', 'Ok7Nm7dcmF', 'njONY1SF08', 'eT29N2BPdc', 'r9LNhqbT9p', 'caTNlMgy8r'
Source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.34fc620.8.raw.unpack, XQ5d7tr2H7O3ZFaBM3u.cs	High entropy of concatenated method names: 'GaYryHtNCX', 'T5XrQ6VWSP', 'gyFrkMTKHI', 'vsYr3TR40U', 'fxVrDVSHKa', 'JL9rNSbtXx', 'tulr0pYCF6', 'WC5rWgUwwP', 'QZpri2dIw6', 'VvurUYDuhj'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473407134.00000000021A7000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Memory allocated: 340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Memory allocated: 20E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Memory allocated: 470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Memory allocated: 310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Memory allocated: 2120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Memory allocated: 6C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Window / User API: threadDelayed 1230			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Window / User API: threadDelayed 8598			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr TID: 3500	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr TID: 3500	Thread sleep time: -7200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr TID: 3504	Thread sleep count: 1230 > 30	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr TID: 3504	Thread sleep count: 8598 > 30	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr TID: 3748	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Thread delayed: delay time: 600000			Jump to behavior

Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473407134.00000000021A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: QUOTATION_MARQUOTE312025#U00faPDF.scr, 00000000.00000002.473407134.00000000021A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

Memory written: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr base: F0000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

Process created: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr "C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr"

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Queries volume information: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Queries volume information: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MSIL Logger

Source: Yara match	File source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.476666794.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.626748654.00000000000F2000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.476666794.00000000031B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3704, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000002.00000002.627060723.0000000002121000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3704, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_MARQUOTE312025#U00faPDF.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior

Source: Yara match	File source: 00000002.00000002.627060723.0000000002237000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3704, type: MEMORYSTR

Remote Access Functionality

Yara detected MSIL Logger

Source: Yara match	File source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_MARQUOTE312025#U00faPDF.scr.31da600.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.476666794.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.626748654.00000000000F2000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.476666794.00000000031B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3704, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000002.00000002.627060723.0000000002121000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_MARQUOTE312025#U00faPDF.scr PID: 3704, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Modify Registry	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Software Packing	Proc Filesystem	13 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QUOTATION_MARQUOTE312025#U00faPDF.scr

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
QUOTATION_MARQUOTE312025#U00faPDF.scr