Windows Analysis Report
RFQ 0400-ENPI-RQMA.exe

Machine Learning detection for sample

Source: Yara match	File source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1927201157.0000000001300000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1926547005.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2175893456.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2175933717.0000000003020000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2913084591.0000000004B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1928973003.00000000017E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2896021580.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: RFQ 0400-ENPI-RQMA.exe

Joe Sandbox ML: detected

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: aYJw.pdb source: RFQ 0400-ENPI-RQMA.exe
Source:	Binary string: replace.pdb source: RFQ 0400-ENPI-RQMA.exe, 00000002.00000002.1926765955.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000002.2895608255.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000003.1866058996.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: replace.pdbGCTL source: RFQ 0400-ENPI-RQMA.exe, 00000002.00000002.1926765955.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000002.2895608255.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000003.1866058996.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: KdcHSkcpIgYD.exe, 00000004.00000000.1853172112.00000000009BE000.00000002.00000001.01000000.0000000D.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2897838287.00000000009BE000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: wntdll.pdbUGP source: RFQ 0400-ENPI-RQMA.exe, 00000002.00000002.1927402660.0000000001390000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000005.00000003.1928920536.0000000002FB6000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.2176003269.0000000003160000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000005.00000003.1926857156.0000000002E0E000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.2176003269.00000000032FE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RFQ 0400-ENPI-RQMA.exe, RFQ 0400-ENPI-RQMA.exe, 00000002.00000002.1927402660.0000000001390000.00000040.00001000.00020000.00000000.sdmp, replace.exe, replace.exe, 00000005.00000003.1928920536.0000000002FB6000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.2176003269.0000000003160000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000005.00000003.1926857156.0000000002E0E000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.2176003269.00000000032FE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: aYJw.pdbSHA256 source: RFQ 0400-ENPI-RQMA.exe

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Code function: 4x nop then jmp 07D87AD1h

0_2_07D871E1

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49743 -> 79.98.25.1:80

Source: Joe Sandbox View

IP Address: 79.98.25.1 79.98.25.1

Source: Joe Sandbox View

ASN Name: RACKRAYUABRakrejusLT RACKRAYUABRakrejusLT

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /aleu/?lT2ltVXh=ok/gmcxpcerYYESV9LVelGsDrZokr4IbVWXcVokfXup7b9fdD39fjj06OXsQXJEXHKhiFziBALjD8i0StjfBb+96LAD/3UXNvlvrkMKLP/jNG9hi36bWzAk=&66=uX3d2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Host: www.maxiwalls.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36

Source: unknown

DNS traffic detected: queries for: www.maxiwalls.com

Source: RFQ 0400-ENPI-RQMA.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: RFQ 0400-ENPI-RQMA.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: RFQ 0400-ENPI-RQMA.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: RFQ 0400-ENPI-RQMA.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661760268.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comar
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://assets.iv.lt/default.css
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://assets.iv.lt/footer.html
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://assets.iv.lt/header.html
Source: firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://assets.iv.lt/images/icon.png
Source: firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://assets.iv.lt/images/thumbnail.png
Source: replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://klientams.iv.lt/
Source: replace.exe, 00000005.00000002.2175137923.0000000002B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: replace.exe, 00000005.00000002.2175137923.0000000002B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: replace.exe, 00000005.00000002.2175137923.0000000002B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: replace.exe, 00000005.00000002.2175137923.0000000002B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: replace.exe, 00000005.00000002.2175137923.0000000002B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: replace.exe, 00000005.00000003.2106155503.0000000007BDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: RFQ 0400-ENPI-RQMA.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iv.lt/
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iv.lt/domenai/
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iv.lt/duomenu-centras/
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iv.lt/el-pasto-filtras/
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iv.lt/neribotas-svetainiu-talpinimas/
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iv.lt/profesionalus-hostingas/
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iv.lt/sertifikatai/
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iv.lt/svetainiu-kurimo-irankis/
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iv.lt/talpinimo-planai/
Source: replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iv.lt/vps-serveriai/

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1927201157.0000000001300000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1926547005.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2175893456.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2175933717.0000000003020000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2913084591.0000000004B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1928973003.00000000017E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2896021580.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1927201157.0000000001300000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1926547005.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2175893456.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2175933717.0000000003020000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.2913084591.0000000004B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1928973003.00000000017E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2896021580.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

.NET source code contains very large array initializations

Source: 0.2.RFQ 0400-ENPI-RQMA.exe.32e5318.4.raw.unpack, HomeView.cs	Large array initialization: : array initializer size 33604
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.7ae0000.11.raw.unpack, HomeView.cs	Large array initialization: : array initializer size 33604

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: RFQ 0400-ENPI-RQMA.exe

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0042B233 NtClose,	2_2_0042B233
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014035C0 NtCreateMutant,LdrInitializeThunk,	2_2_014035C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402B60 NtClose,LdrInitializeThunk,	2_2_01402B60
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_01402DF0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_01402C70
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01403010 NtOpenDirectoryObject,	2_2_01403010
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01403090 NtSetValueKey,	2_2_01403090
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01404340 NtSetContextThread,	2_2_01404340
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01404650 NtSuspendThread,	2_2_01404650
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014039B0 NtGetContextThread,	2_2_014039B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402BE0 NtQueryValueKey,	2_2_01402BE0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402BF0 NtAllocateVirtualMemory,	2_2_01402BF0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402B80 NtQueryInformationFile,	2_2_01402B80
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402BA0 NtEnumerateValueKey,	2_2_01402BA0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402AD0 NtReadFile,	2_2_01402AD0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402AF0 NtWriteFile,	2_2_01402AF0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402AB0 NtWaitForSingleObject,	2_2_01402AB0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01403D70 NtOpenThread,	2_2_01403D70
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402D00 NtSetInformationFile,	2_2_01402D00
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402D10 NtMapViewOfSection,	2_2_01402D10
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01403D10 NtOpenProcessToken,	2_2_01403D10
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402D30 NtUnmapViewOfSection,	2_2_01402D30
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402DD0 NtDelayExecution,	2_2_01402DD0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402DB0 NtEnumerateKey,	2_2_01402DB0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402C60 NtCreateKey,	2_2_01402C60
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402C00 NtQueryInformationProcess,	2_2_01402C00
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402CC0 NtQueryVirtualMemory,	2_2_01402CC0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402CF0 NtOpenProcess,	2_2_01402CF0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402CA0 NtQueryInformationToken,	2_2_01402CA0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402F60 NtCreateProcessEx,	2_2_01402F60
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402F30 NtCreateSection,	2_2_01402F30
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402FE0 NtCreateFile,	2_2_01402FE0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402F90 NtProtectVirtualMemory,	2_2_01402F90
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402FA0 NtQuerySection,	2_2_01402FA0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402FB0 NtResumeThread,	2_2_01402FB0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402E30 NtWriteVirtualMemory,	2_2_01402E30
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402EE0 NtQueueApcThread,	2_2_01402EE0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402E80 NtReadVirtualMemory,	2_2_01402E80
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01402EA0 NtAdjustPrivilegesToken,	2_2_01402EA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D4340 NtSetContextThread,LdrInitializeThunk,	5_2_031D4340
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D4650 NtSuspendThread,LdrInitializeThunk,	5_2_031D4650
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2B60 NtClose,LdrInitializeThunk,	5_2_031D2B60
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_031D2BA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_031D2BF0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_031D2BE0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2AD0 NtReadFile,LdrInitializeThunk,	5_2_031D2AD0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2AF0 NtWriteFile,LdrInitializeThunk,	5_2_031D2AF0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2F30 NtCreateSection,LdrInitializeThunk,	5_2_031D2F30
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2FB0 NtResumeThread,LdrInitializeThunk,	5_2_031D2FB0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2FE0 NtCreateFile,LdrInitializeThunk,	5_2_031D2FE0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_031D2E80
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_031D2EE0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_031D2D10
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_031D2D30
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2DD0 NtDelayExecution,LdrInitializeThunk,	5_2_031D2DD0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_031D2DF0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_031D2C70
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2C60 NtCreateKey,LdrInitializeThunk,	5_2_031D2C60
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_031D2CA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D35C0 NtCreateMutant,LdrInitializeThunk,	5_2_031D35C0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D39B0 NtGetContextThread,LdrInitializeThunk,	5_2_031D39B0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2B80 NtQueryInformationFile,	5_2_031D2B80
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2AB0 NtWaitForSingleObject,	5_2_031D2AB0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2F60 NtCreateProcessEx,	5_2_031D2F60
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2F90 NtProtectVirtualMemory,	5_2_031D2F90
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2FA0 NtQuerySection,	5_2_031D2FA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2E30 NtWriteVirtualMemory,	5_2_031D2E30
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2EA0 NtAdjustPrivilegesToken,	5_2_031D2EA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2D00 NtSetInformationFile,	5_2_031D2D00
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2DB0 NtEnumerateKey,	5_2_031D2DB0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2C00 NtQueryInformationProcess,	5_2_031D2C00
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2CC0 NtQueryVirtualMemory,	5_2_031D2CC0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D2CF0 NtOpenProcess,	5_2_031D2CF0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D3010 NtOpenDirectoryObject,	5_2_031D3010
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D3090 NtSetValueKey,	5_2_031D3090
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D3D10 NtOpenProcessToken,	5_2_031D3D10
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D3D70 NtOpenThread,	5_2_031D3D70

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_016ADA4C	0_2_016ADA4C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B27F61	0_2_07B27F61
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B23C01	0_2_07B23C01
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B27C48	0_2_07B27C48
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B24AB0	0_2_07B24AB0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B22910	0_2_07B22910
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B23659	0_2_07B23659
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B2C4CC	0_2_07B2C4CC
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B2C310	0_2_07B2C310
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B2C301	0_2_07B2C301
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B2A200	0_2_07B2A200
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B23189	0_2_07B23189
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B2A1F0	0_2_07B2A1F0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B2A1C9	0_2_07B2A1C9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B28EE0	0_2_07B28EE0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B26E00	0_2_07B26E00
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B21DF9	0_2_07B21DF9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B26BC8	0_2_07B26BC8
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B259A0	0_2_07B259A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B249C1	0_2_07B249C1
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B2290B	0_2_07B2290B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B26857	0_2_07B26857
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07D89100	0_2_07D89100
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07D84CC0	0_2_07D84CC0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07D834B8	0_2_07D834B8
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07D84CB0	0_2_07D84CB0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07D82C48	0_2_07D82C48
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07D850F8	0_2_07D850F8
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07D83070	0_2_07D83070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07D80007	0_2_07D80007
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00401190	2_2_00401190
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00403210	2_2_00403210
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00402313	2_2_00402313
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00402320	2_2_00402320
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00402510	2_2_00402510
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0040FD1A	2_2_0040FD1A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0040FD23	2_2_0040FD23
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0042D673	2_2_0042D673
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_004166C3	2_2_004166C3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_004166BE	2_2_004166BE
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0040FF43	2_2_0040FF43
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00402750	2_2_00402750
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0040DFC3	2_2_0040DFC3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01458158	2_2_01458158
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0149B16B	2_2_0149B16B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0140516C	2_2_0140516C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C0100	2_2_013C0100
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146A118	2_2_0146A118
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014881CC	2_2_014881CC
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DB1B0	2_2_013DB1B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014901AA	2_2_014901AA
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147F0CC	2_2_0147F0CC
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014870E9	2_2_014870E9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148F0E0	2_2_0148F0E0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148A352	2_2_0148A352
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148132D	2_2_0148132D
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BD34C	2_2_013BD34C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014903E6	2_2_014903E6
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DE3F0	2_2_013DE3F0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0141739A	2_2_0141739A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014502C0	2_2_014502C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D52A0	2_2_013D52A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013ED2F0	2_2_013ED2F0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EB2C0	2_2_013EB2C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D0535	2_2_013D0535
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01487571	2_2_01487571
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01490591	2_2_01490591
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146D5B0	2_2_0146D5B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01482446	2_2_01482446
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C1460	2_2_013C1460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148F43F	2_2_0148F43F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147E4F6	2_2_0147E4F6
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D0770	2_2_013D0770
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F4750	2_2_013F4750
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148F7B0	2_2_0148F7B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CC7C0	2_2_013CC7C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014816CC	2_2_014816CC
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EC6E0	2_2_013EC6E0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E6962	2_2_013E6962
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D9950	2_2_013D9950
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EB950	2_2_013EB950
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D29A0	2_2_013D29A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0149A9A6	2_2_0149A9A6
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0143D800	2_2_0143D800
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DA840	2_2_013DA840
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D2840	2_2_013D2840
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B68B8	2_2_013B68B8
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FE8F0	2_2_013FE8F0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D38E0	2_2_013D38E0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148AB40	2_2_0148AB40
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148FB76	2_2_0148FB76
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01486BD7	2_2_01486BD7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01445BF0	2_2_01445BF0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0140DBF9	2_2_0140DBF9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EFB80	2_2_013EFB80
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148FA49	2_2_0148FA49
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01487A46	2_2_01487A46
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01443A6C	2_2_01443A6C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147DAC6	2_2_0147DAC6
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CEA80	2_2_013CEA80
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01415AA0	2_2_01415AA0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146DAAC	2_2_0146DAAC
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01481D5A	2_2_01481D5A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01487D73	2_2_01487D73
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DAD00	2_2_013DAD00
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D3D40	2_2_013D3D40
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E8DBF	2_2_013E8DBF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CADE0	2_2_013CADE0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EFDC0	2_2_013EFDC0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D0C00	2_2_013D0C00
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01449C32	2_2_01449C32
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148FCF2	2_2_0148FCF2
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C0CF2	2_2_013C0CF2
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470CB5	2_2_01470CB5
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01444F40	2_2_01444F40
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F0F30	2_2_013F0F30
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148FF09	2_2_0148FF09
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01412F28	2_2_01412F28
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1F92	2_2_013D1F92
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144EFA0	2_2_0144EFA0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01393FD2	2_2_01393FD2
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01393FD5	2_2_01393FD5
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C2FC8	2_2_013C2FC8
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148FFB1	2_2_0148FFB1
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D0E59	2_2_013D0E59
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148EE26	2_2_0148EE26
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D9EB0	2_2_013D9EB0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148EEDB	2_2_0148EEDB
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E2E90	2_2_013E2E90
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148CE93	2_2_0148CE93
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325A352	5_2_0325A352
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032603E6	5_2_032603E6
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031AE3F0	5_2_031AE3F0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03240274	5_2_03240274
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032202C0	5_2_032202C0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03190100	5_2_03190100
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0323A118	5_2_0323A118
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03228158	5_2_03228158
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032541A2	5_2_032541A2
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032601AA	5_2_032601AA
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032581CC	5_2_032581CC
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03232000	5_2_03232000
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031C4750	5_2_031C4750
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A0770	5_2_031A0770
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0319C7C0	5_2_0319C7C0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031BC6E0	5_2_031BC6E0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A0535	5_2_031A0535
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03260591	5_2_03260591
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03244420	5_2_03244420
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03252446	5_2_03252446
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0324E4F6	5_2_0324E4F6
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325AB40	5_2_0325AB40
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03256BD7	5_2_03256BD7
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0319EA80	5_2_0319EA80
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031B6962	5_2_031B6962
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0326A9A6	5_2_0326A9A6
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A29A0	5_2_031A29A0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A2840	5_2_031A2840
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031AA840	5_2_031AA840
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031868B8	5_2_031868B8
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031CE8F0	5_2_031CE8F0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03242F30	5_2_03242F30
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031C0F30	5_2_031C0F30
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031E2F28	5_2_031E2F28
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03214F40	5_2_03214F40
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0321EFA0	5_2_0321EFA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325EE26	5_2_0325EE26
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A0E59	5_2_031A0E59
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031B2E90	5_2_031B2E90
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325CE93	5_2_0325CE93
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325EEDB	5_2_0325EEDB
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031AAD00	5_2_031AAD00
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0323CD1F	5_2_0323CD1F
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031B8DBF	5_2_031B8DBF
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0319ADE0	5_2_0319ADE0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A0C00	5_2_031A0C00
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03240CB5	5_2_03240CB5
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03190CF2	5_2_03190CF2
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325132D	5_2_0325132D
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0318D34C	5_2_0318D34C
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031E739A	5_2_031E739A
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A52A0	5_2_031A52A0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032412ED	5_2_032412ED
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031BB2C0	5_2_031BB2C0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031BD2F0	5_2_031BD2F0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0326B16B	5_2_0326B16B
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0318F172	5_2_0318F172
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D516C	5_2_031D516C
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031AB1B0	5_2_031AB1B0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325F0E0	5_2_0325F0E0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032570E9	5_2_032570E9
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A70C0	5_2_031A70C0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0324F0CC	5_2_0324F0CC
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325F7B0	5_2_0325F7B0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031E5630	5_2_031E5630
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032516CC	5_2_032516CC
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03257571	5_2_03257571
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0323D5B0	5_2_0323D5B0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032695C3	5_2_032695C3
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325F43F	5_2_0325F43F
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03191460	5_2_03191460
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325FB76	5_2_0325FB76
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031BFB80	5_2_031BFB80
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03215BF0	5_2_03215BF0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031DDBF9	5_2_031DDBF9
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03213A6C	5_2_03213A6C
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03257A46	5_2_03257A46
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325FA49	5_2_0325FA49
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03241AA3	5_2_03241AA3
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0323DAAC	5_2_0323DAAC
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031E5AA0	5_2_031E5AA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0324DAC6	5_2_0324DAC6
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03235910	5_2_03235910
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A9950	5_2_031A9950
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031BB950	5_2_031BB950
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320D800	5_2_0320D800
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A38E0	5_2_031A38E0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325FF09	5_2_0325FF09
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A1F92	5_2_031A1F92
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325FFB1	5_2_0325FFB1
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A9EB0	5_2_031A9EB0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03257D73	5_2_03257D73
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031A3D40	5_2_031A3D40
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03251D5A	5_2_03251D5A
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031BFDC0	5_2_031BFDC0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03219C32	5_2_03219C32
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0325FCF2	5_2_0325FCF2

Source: C:\Windows\SysWOW64\replace.exe	Code function: String function: 0320EA12 appears 86 times
Source: C:\Windows\SysWOW64\replace.exe	Code function: String function: 031E7E54 appears 107 times
Source: C:\Windows\SysWOW64\replace.exe	Code function: String function: 0318B970 appears 262 times
Source: C:\Windows\SysWOW64\replace.exe	Code function: String function: 031D5130 appears 58 times
Source: C:\Windows\SysWOW64\replace.exe	Code function: String function: 0321F290 appears 103 times
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: String function: 0143EA12 appears 86 times
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: String function: 01405130 appears 36 times
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: String function: 0144F290 appears 103 times
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: String function: 013BB970 appears 254 times
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: String function: 01417E54 appears 94 times

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: invalid certificate

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1657413936.00000000016DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RFQ 0400-ENPI-RQMA.exe
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1657993465.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs RFQ 0400-ENPI-RQMA.exe
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1663447736.0000000007AE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs RFQ 0400-ENPI-RQMA.exe
Source: RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1657755988.00000000031D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs RFQ 0400-ENPI-RQMA.exe
Source: RFQ 0400-ENPI-RQMA.exe, 00000002.00000002.1926765955.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameREPLACE.EXEj% vs RFQ 0400-ENPI-RQMA.exe
Source: RFQ 0400-ENPI-RQMA.exe, 00000002.00000002.1926765955.0000000000E5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameREPLACE.EXEj% vs RFQ 0400-ENPI-RQMA.exe
Source: RFQ 0400-ENPI-RQMA.exe, 00000002.00000002.1927402660.00000000014BD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ 0400-ENPI-RQMA.exe
Source: RFQ 0400-ENPI-RQMA.exe	Binary or memory string: OriginalFilenameaYJw.exe& vs RFQ 0400-ENPI-RQMA.exe

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1927201157.0000000001300000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1926547005.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2175893456.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2175933717.0000000003020000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.2913084591.0000000004B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1928973003.00000000017E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2896021580.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	Security API names: _0020.SetAccessControl
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	Security API names: _0020.AddAccessRule
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, rDIp5G8onoljg2aKqn.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, rDIp5G8onoljg2aKqn.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, rDIp5G8onoljg2aKqn.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	Security API names: _0020.SetAccessControl
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	Security API names: _0020.AddAccessRule
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	Security API names: _0020.SetAccessControl
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@1/1

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ 0400-ENPI-RQMA.exe.log

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Mutant created: NULL

Source: C:\Windows\SysWOW64\replace.exe

File created: C:\Users\user\AppData\Local\Temp\C3vB7APK

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RFQ 0400-ENPI-RQMA.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: replace.exe, 00000005.00000003.2110529013.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.2175137923.0000000002B98000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: RFQ 0400-ENPI-RQMA.exe

ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

File read: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe:Zone.Identifier

Source: unknown	Process created: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe "C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe"
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process created: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe "C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe"
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	Process created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"
Source: C:\Windows\SysWOW64\replace.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process created: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe "C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe"	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	Process created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\replace.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: aYJw.pdb source: RFQ 0400-ENPI-RQMA.exe
Source:	Binary string: replace.pdb source: RFQ 0400-ENPI-RQMA.exe, 00000002.00000002.1926765955.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000002.2895608255.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000003.1866058996.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: replace.pdbGCTL source: RFQ 0400-ENPI-RQMA.exe, 00000002.00000002.1926765955.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000002.2895608255.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000003.1866058996.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: KdcHSkcpIgYD.exe, 00000004.00000000.1853172112.00000000009BE000.00000002.00000001.01000000.0000000D.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2897838287.00000000009BE000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: wntdll.pdbUGP source: RFQ 0400-ENPI-RQMA.exe, 00000002.00000002.1927402660.0000000001390000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000005.00000003.1928920536.0000000002FB6000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.2176003269.0000000003160000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000005.00000003.1926857156.0000000002E0E000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.2176003269.00000000032FE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RFQ 0400-ENPI-RQMA.exe, RFQ 0400-ENPI-RQMA.exe, 00000002.00000002.1927402660.0000000001390000.00000040.00001000.00020000.00000000.sdmp, replace.exe, replace.exe, 00000005.00000003.1928920536.0000000002FB6000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.2176003269.0000000003160000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000005.00000003.1926857156.0000000002E0E000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.2176003269.00000000032FE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: aYJw.pdbSHA256 source: RFQ 0400-ENPI-RQMA.exe

Data Obfuscation

Source: RFQ 0400-ENPI-RQMA.exe, Form1.cs	.Net Code: InitializeComponent
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	.Net Code: UR0T1nKqk3 System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	.Net Code: UR0T1nKqk3 System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.32e5318.4.raw.unpack, HomeView.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	.Net Code: UR0T1nKqk3 System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.7ae0000.11.raw.unpack, HomeView.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: 0xECE1BD42 [Thu Dec 8 21:10:26 2095 UTC]

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_016AE460 pushfd ; retf	0_2_016AE461
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B24507 pushad ; retf	0_2_07B24508
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07B244FD pushad ; retf	0_2_07B244FE
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07D8676F pushad ; retf	0_2_07D8677D
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 0_2_07D86847 push esp; retf	0_2_07D86855
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00416023 push ds; ret	2_2_00416071
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00404834 push ebx; ret	2_2_00404835
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0040A036 push es; ret	2_2_0040A039
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_004119A0 pushfd ; iretd	2_2_004119B2
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00409A42 push ecx; ret	2_2_00409A46
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0040D276 push ebx; retf	2_2_0040D29A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0040D214 push ecx; iretd	2_2_0040D215
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00418B17 push ss; retf	2_2_00418B1B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_004074E7 pushad ; iretd	2_2_004074F3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00403490 push eax; ret	2_2_00403492
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00409D5A push cs; retf	2_2_00409D5B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_00406524 push es; iretd	2_2_00406530
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_004145D8 pushfd ; ret	2_2_004145D9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0040CE54 push cs; iretd	2_2_0040CE5B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0139225F pushad ; ret	2_2_013927F9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013927FA pushad ; ret	2_2_013927F9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01399939 push es; iretd	2_2_01399940
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C09AD push ecx; mov dword ptr [esp], ecx	2_2_013C09B6
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0139283D push eax; iretd	2_2_01392858
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0316225F pushad ; ret	5_2_031627F9
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031627FA pushad ; ret	5_2_031627F9
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031909AD push ecx; mov dword ptr [esp], ecx	5_2_031909B6
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0316283D push eax; iretd	5_2_03162858
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03161368 push eax; iretd	5_2_03161369

Source: RFQ 0400-ENPI-RQMA.exe

Static PE information: section name: .text entropy: 7.96453329112393

Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, YoSM6Wp2IrmhKrj3ZC.cs	High entropy of concatenated method names: 'EHpkOZGoim', 'WA1kLrXTxA', 'KAwkw91x1C', 'aXAkaIv7QY', 'oyaksa6BYE', 'ClbkI8eig4', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, uVaeFkcPeaH3ocHSEv0.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'h3ABspXNn4', 'bprB6oEHSI', 'OOwBhWr7FM', 'qslB2At04s', 'JNlBRH3Aso', 'ylhBxsepID', 'LGOBdMLWa6'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, XIpVv9AC41Lf2l6L2Q.cs	High entropy of concatenated method names: 'buojqmtYbm', 'LlojXKNTWv', 'CUUjmU9wpL', 'idLm5VJxhU', 'p2mmzMhrcr', 'MqljNyE9lA', 'xePjJ4ybse', 'wTMj3qPZl1', 'sQxjy54DYA', 'DM0jTyba28'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, yR7kGq657qmGnh4tKL.cs	High entropy of concatenated method names: 'Dispose', 'rt7JecR04u', 'vPl3LjlNpq', 'Mya44ixB1G', 'TG4J5Nl5ID', 'ERhJzRwAix', 'ProcessDialogKey', 'ViF3NgEZAV', 'CAt3JRHo3Y', 'kbU337WtIm'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, MYD0nFMdGQovafxJ7Z.cs	High entropy of concatenated method names: 'ToString', 'TXg7ENvWeS', 'dG17LdNH2W', 'RH17wjMabu', 'gVC7ar2iUl', 'fpt7INJBos', 'k7D7FOv6Zx', 'x0G7SN6d4H', 'UfC7iXNd2H', 'JiD7p8YshM'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	High entropy of concatenated method names: 'w0Pyco7jh7', 'nQMyqKQ0CB', 'JU3yPigGWy', 'fK2yX0Tmbq', 'L1OyYsdiWV', 'tUcymZSjEr', 'd9KyjFcQbs', 'mYvyUcW6O4', 'z7UyGZvsFt', 'cXcyChiKNm'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, v1EZnFxqBBh6XGqBr0.cs	High entropy of concatenated method names: 'ga7JjlR6FY', 'bOqJU3jPNZ', 'HNAJC2px6b', 'exJJHlHYga', 'TLfJKV4JKO', 'hSPJ7Cx93G', 'K4CWXHXaqrx2gKV2CN', 'Kb7wV8IIRBUbVtH4nt', 'qfL18rE5SgLOYfGNeO', 'z68JJQ1JoN'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, ynG9sBnaZATAKmVTe7.cs	High entropy of concatenated method names: 'aK41hKnqs', 'gEiZ7GbsC', 'IhX9M8pPa', 'dJi8lPsuF', 'z9tAIhOVH', 'b8juMXYIt', 'jcnDVa0umTBv8BGfWG', 'aJ6Xhf27CApeSBSRRh', 'NL2kZUIWP', 'I7yBpceb2'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, bcqsqkytaUAL9e8ErJ.cs	High entropy of concatenated method names: 'SXkoJ5XlMN', 'CPMoyaxOBX', 'tBUoT5y3q9', 'yV6oqWBaS5', 'VG7oPi6Z88', 'ElPoYlRwDR', 'xHDomnhDYP', 'BTBkdRC1EA', 'AMrkv5qsnA', 'xUJket4wiQ'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, rDIp5G8onoljg2aKqn.cs	High entropy of concatenated method names: 'GyEPsNGmbc', 'AeKP60Dcmb', 'fIQPhkuffT', 'r8kP2QiRoi', 'IFOPRb9hr3', 'i8KPx6pawM', 'ab2PdaQLtM', 'uPrPvfrUkR', 'PEePey8bVA', 'yFhP5KOi9N'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, KJLWMFUAwl9EjQ3Nxn.cs	High entropy of concatenated method names: 'pPZkqFnMuO', 'gKtkPlZJyb', 'fyOkX3Ypin', 'WMOkYIcsRd', 'uD3km0phmX', 'srRkjXBgAq', 'dIKkUuJ25Y', 'TWtkGqLEyw', 'VASkCJDl12', 'IhCkHVp5fj'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, ySKAX7gAV1CMZRPs6r.cs	High entropy of concatenated method names: 'uTOXZij8dh', 'r4qX9kwnlq', 'MVWXfxGigI', 'RWUXAwx6wh', 'UvyXKw7iD5', 'fShX7Z91Y4', 'WdBXtLkiQ6', 'dD3XkrQfFf', 'u7yXoaEKFj', 'VR7XBOUxXb'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, QSK4KUc4JILpZ3IpyRw.cs	High entropy of concatenated method names: 'VpqobrK9uA', 'rlVorSeCXt', 'G2oo1iR30C', 'NwRoZvZKd9', 'nCkonvFPUF', 'iYPo9ytsxA', 'kEco8oBvIe', 'ENGofls0qS', 'VPioAKXnss', 'gDvouoKYhp'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, uXWt4EzWmqvJcLS2dM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uiloM7MHuq', 'HRwoKmJojI', 'XHpo7RKDXT', 'x7Cot2jC8d', 'TRsokBIMEX', 'eG3oonQSXG', 'rLuoB7c2V9'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, grvkySDx2bMBUo2s1j.cs	High entropy of concatenated method names: 'Ii0tvRG7t9', 'KZft53SoFD', 'mJrkN6mqCr', 'APEkJDAwXq', 'vTOtEF0RNb', 't2rtDwfmRs', 'lSAtl1Vn71', 'oRIts0p6aB', 'NGbt6cqQcm', 's3AthSjkI6'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, GJJWFJkvd2VZBSbtjl.cs	High entropy of concatenated method names: 'jn8tCKY4Ck', 'EpitHys6B7', 'ToString', 'S40tqJnNbW', 'WettPrSuU5', 'Pa5tXD9rQB', 'mwitYiioBl', 'RnXtmwNDum', 'FTrtjtw5W8', 'd0ltU7gMUm'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, A8gFw3myrZdLsbB0jH.cs	High entropy of concatenated method names: 'hGoKV6pOP2', 'sDTKD6DAZl', 'D4TKsanD9P', 'SasK63Llaa', 'WFxKLVIpSQ', 'MyXKwq2vTU', 'wNyKa0NaZX', 'etEKIpeQwt', 'A0jKFCyT2p', 'TCLKSLsBAh'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, mQ0RGZYiDcvttbn8xA.cs	High entropy of concatenated method names: 'l01MfqMb0E', 'qeHMA1vonM', 'ME5MOCN54K', 'mXbMLwjK0S', 'bAvMaMexpa', 'GqfMIdE1tK', 'TaHMSNopXT', 'x88Mi2sc0L', 'xoLMVWXQC5', 'zeBMEjCkaL'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, JtfGZgjgKQWLSBqGf3.cs	High entropy of concatenated method names: 'LbfmcoYk6u', 'MV4mPPCLnY', 'P5JmYVhp03', 'la1mjB4EAP', 'xMmmUGtyGI', 'rl5YRHNysM', 'c5OYxKt6JN', 'dbGYdNW8td', 'qmtYvMqXKX', 'frYYeddTyN'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, bTPDcirfT3DGP9qfd1.cs	High entropy of concatenated method names: 'yPwYn0ZEad', 'ckJY8sQgtx', 'X2EXw7jaGY', 'yqJXaRAPmK', 'WrNXIEehvy', 'tNsXFB1nT7', 'rpmXSEgCcO', 'Xt6XiBYCTH', 'xKBXppOemy', 'AEjXVowRsU'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4f48240.10.raw.unpack, MDFNbnfWwmWjgD7ikE.cs	High entropy of concatenated method names: 'EZjjbluCTR', 'rcWjrtlD8U', 'ALDj1TjIys', 'zhyjZtkuHb', 'GCQjnFDD2h', 'KUsj9EVZR5', 'c0dj8Eynfa', 'HT6jfnLUrW', 'Jk7jAleOSw', 'z0hjudJV8m'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, YoSM6Wp2IrmhKrj3ZC.cs	High entropy of concatenated method names: 'EHpkOZGoim', 'WA1kLrXTxA', 'KAwkw91x1C', 'aXAkaIv7QY', 'oyaksa6BYE', 'ClbkI8eig4', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, uVaeFkcPeaH3ocHSEv0.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'h3ABspXNn4', 'bprB6oEHSI', 'OOwBhWr7FM', 'qslB2At04s', 'JNlBRH3Aso', 'ylhBxsepID', 'LGOBdMLWa6'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, XIpVv9AC41Lf2l6L2Q.cs	High entropy of concatenated method names: 'buojqmtYbm', 'LlojXKNTWv', 'CUUjmU9wpL', 'idLm5VJxhU', 'p2mmzMhrcr', 'MqljNyE9lA', 'xePjJ4ybse', 'wTMj3qPZl1', 'sQxjy54DYA', 'DM0jTyba28'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, yR7kGq657qmGnh4tKL.cs	High entropy of concatenated method names: 'Dispose', 'rt7JecR04u', 'vPl3LjlNpq', 'Mya44ixB1G', 'TG4J5Nl5ID', 'ERhJzRwAix', 'ProcessDialogKey', 'ViF3NgEZAV', 'CAt3JRHo3Y', 'kbU337WtIm'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, MYD0nFMdGQovafxJ7Z.cs	High entropy of concatenated method names: 'ToString', 'TXg7ENvWeS', 'dG17LdNH2W', 'RH17wjMabu', 'gVC7ar2iUl', 'fpt7INJBos', 'k7D7FOv6Zx', 'x0G7SN6d4H', 'UfC7iXNd2H', 'JiD7p8YshM'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	High entropy of concatenated method names: 'w0Pyco7jh7', 'nQMyqKQ0CB', 'JU3yPigGWy', 'fK2yX0Tmbq', 'L1OyYsdiWV', 'tUcymZSjEr', 'd9KyjFcQbs', 'mYvyUcW6O4', 'z7UyGZvsFt', 'cXcyChiKNm'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, v1EZnFxqBBh6XGqBr0.cs	High entropy of concatenated method names: 'ga7JjlR6FY', 'bOqJU3jPNZ', 'HNAJC2px6b', 'exJJHlHYga', 'TLfJKV4JKO', 'hSPJ7Cx93G', 'K4CWXHXaqrx2gKV2CN', 'Kb7wV8IIRBUbVtH4nt', 'qfL18rE5SgLOYfGNeO', 'z68JJQ1JoN'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, ynG9sBnaZATAKmVTe7.cs	High entropy of concatenated method names: 'aK41hKnqs', 'gEiZ7GbsC', 'IhX9M8pPa', 'dJi8lPsuF', 'z9tAIhOVH', 'b8juMXYIt', 'jcnDVa0umTBv8BGfWG', 'aJ6Xhf27CApeSBSRRh', 'NL2kZUIWP', 'I7yBpceb2'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, bcqsqkytaUAL9e8ErJ.cs	High entropy of concatenated method names: 'SXkoJ5XlMN', 'CPMoyaxOBX', 'tBUoT5y3q9', 'yV6oqWBaS5', 'VG7oPi6Z88', 'ElPoYlRwDR', 'xHDomnhDYP', 'BTBkdRC1EA', 'AMrkv5qsnA', 'xUJket4wiQ'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, rDIp5G8onoljg2aKqn.cs	High entropy of concatenated method names: 'GyEPsNGmbc', 'AeKP60Dcmb', 'fIQPhkuffT', 'r8kP2QiRoi', 'IFOPRb9hr3', 'i8KPx6pawM', 'ab2PdaQLtM', 'uPrPvfrUkR', 'PEePey8bVA', 'yFhP5KOi9N'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, KJLWMFUAwl9EjQ3Nxn.cs	High entropy of concatenated method names: 'pPZkqFnMuO', 'gKtkPlZJyb', 'fyOkX3Ypin', 'WMOkYIcsRd', 'uD3km0phmX', 'srRkjXBgAq', 'dIKkUuJ25Y', 'TWtkGqLEyw', 'VASkCJDl12', 'IhCkHVp5fj'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, ySKAX7gAV1CMZRPs6r.cs	High entropy of concatenated method names: 'uTOXZij8dh', 'r4qX9kwnlq', 'MVWXfxGigI', 'RWUXAwx6wh', 'UvyXKw7iD5', 'fShX7Z91Y4', 'WdBXtLkiQ6', 'dD3XkrQfFf', 'u7yXoaEKFj', 'VR7XBOUxXb'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, QSK4KUc4JILpZ3IpyRw.cs	High entropy of concatenated method names: 'VpqobrK9uA', 'rlVorSeCXt', 'G2oo1iR30C', 'NwRoZvZKd9', 'nCkonvFPUF', 'iYPo9ytsxA', 'kEco8oBvIe', 'ENGofls0qS', 'VPioAKXnss', 'gDvouoKYhp'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, uXWt4EzWmqvJcLS2dM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uiloM7MHuq', 'HRwoKmJojI', 'XHpo7RKDXT', 'x7Cot2jC8d', 'TRsokBIMEX', 'eG3oonQSXG', 'rLuoB7c2V9'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, grvkySDx2bMBUo2s1j.cs	High entropy of concatenated method names: 'Ii0tvRG7t9', 'KZft53SoFD', 'mJrkN6mqCr', 'APEkJDAwXq', 'vTOtEF0RNb', 't2rtDwfmRs', 'lSAtl1Vn71', 'oRIts0p6aB', 'NGbt6cqQcm', 's3AthSjkI6'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, GJJWFJkvd2VZBSbtjl.cs	High entropy of concatenated method names: 'jn8tCKY4Ck', 'EpitHys6B7', 'ToString', 'S40tqJnNbW', 'WettPrSuU5', 'Pa5tXD9rQB', 'mwitYiioBl', 'RnXtmwNDum', 'FTrtjtw5W8', 'd0ltU7gMUm'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, A8gFw3myrZdLsbB0jH.cs	High entropy of concatenated method names: 'hGoKV6pOP2', 'sDTKD6DAZl', 'D4TKsanD9P', 'SasK63Llaa', 'WFxKLVIpSQ', 'MyXKwq2vTU', 'wNyKa0NaZX', 'etEKIpeQwt', 'A0jKFCyT2p', 'TCLKSLsBAh'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, mQ0RGZYiDcvttbn8xA.cs	High entropy of concatenated method names: 'l01MfqMb0E', 'qeHMA1vonM', 'ME5MOCN54K', 'mXbMLwjK0S', 'bAvMaMexpa', 'GqfMIdE1tK', 'TaHMSNopXT', 'x88Mi2sc0L', 'xoLMVWXQC5', 'zeBMEjCkaL'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, JtfGZgjgKQWLSBqGf3.cs	High entropy of concatenated method names: 'LbfmcoYk6u', 'MV4mPPCLnY', 'P5JmYVhp03', 'la1mjB4EAP', 'xMmmUGtyGI', 'rl5YRHNysM', 'c5OYxKt6JN', 'dbGYdNW8td', 'qmtYvMqXKX', 'frYYeddTyN'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, bTPDcirfT3DGP9qfd1.cs	High entropy of concatenated method names: 'yPwYn0ZEad', 'ckJY8sQgtx', 'X2EXw7jaGY', 'yqJXaRAPmK', 'WrNXIEehvy', 'tNsXFB1nT7', 'rpmXSEgCcO', 'Xt6XiBYCTH', 'xKBXppOemy', 'AEjXVowRsU'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.31d0000.0.raw.unpack, MDFNbnfWwmWjgD7ikE.cs	High entropy of concatenated method names: 'EZjjbluCTR', 'rcWjrtlD8U', 'ALDj1TjIys', 'zhyjZtkuHb', 'GCQjnFDD2h', 'KUsj9EVZR5', 'c0dj8Eynfa', 'HT6jfnLUrW', 'Jk7jAleOSw', 'z0hjudJV8m'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, YoSM6Wp2IrmhKrj3ZC.cs	High entropy of concatenated method names: 'EHpkOZGoim', 'WA1kLrXTxA', 'KAwkw91x1C', 'aXAkaIv7QY', 'oyaksa6BYE', 'ClbkI8eig4', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, uVaeFkcPeaH3ocHSEv0.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'h3ABspXNn4', 'bprB6oEHSI', 'OOwBhWr7FM', 'qslB2At04s', 'JNlBRH3Aso', 'ylhBxsepID', 'LGOBdMLWa6'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, XIpVv9AC41Lf2l6L2Q.cs	High entropy of concatenated method names: 'buojqmtYbm', 'LlojXKNTWv', 'CUUjmU9wpL', 'idLm5VJxhU', 'p2mmzMhrcr', 'MqljNyE9lA', 'xePjJ4ybse', 'wTMj3qPZl1', 'sQxjy54DYA', 'DM0jTyba28'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, yR7kGq657qmGnh4tKL.cs	High entropy of concatenated method names: 'Dispose', 'rt7JecR04u', 'vPl3LjlNpq', 'Mya44ixB1G', 'TG4J5Nl5ID', 'ERhJzRwAix', 'ProcessDialogKey', 'ViF3NgEZAV', 'CAt3JRHo3Y', 'kbU337WtIm'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, MYD0nFMdGQovafxJ7Z.cs	High entropy of concatenated method names: 'ToString', 'TXg7ENvWeS', 'dG17LdNH2W', 'RH17wjMabu', 'gVC7ar2iUl', 'fpt7INJBos', 'k7D7FOv6Zx', 'x0G7SN6d4H', 'UfC7iXNd2H', 'JiD7p8YshM'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, F6hFYiiBiVNM4n0oqc.cs	High entropy of concatenated method names: 'w0Pyco7jh7', 'nQMyqKQ0CB', 'JU3yPigGWy', 'fK2yX0Tmbq', 'L1OyYsdiWV', 'tUcymZSjEr', 'd9KyjFcQbs', 'mYvyUcW6O4', 'z7UyGZvsFt', 'cXcyChiKNm'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, v1EZnFxqBBh6XGqBr0.cs	High entropy of concatenated method names: 'ga7JjlR6FY', 'bOqJU3jPNZ', 'HNAJC2px6b', 'exJJHlHYga', 'TLfJKV4JKO', 'hSPJ7Cx93G', 'K4CWXHXaqrx2gKV2CN', 'Kb7wV8IIRBUbVtH4nt', 'qfL18rE5SgLOYfGNeO', 'z68JJQ1JoN'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, ynG9sBnaZATAKmVTe7.cs	High entropy of concatenated method names: 'aK41hKnqs', 'gEiZ7GbsC', 'IhX9M8pPa', 'dJi8lPsuF', 'z9tAIhOVH', 'b8juMXYIt', 'jcnDVa0umTBv8BGfWG', 'aJ6Xhf27CApeSBSRRh', 'NL2kZUIWP', 'I7yBpceb2'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, bcqsqkytaUAL9e8ErJ.cs	High entropy of concatenated method names: 'SXkoJ5XlMN', 'CPMoyaxOBX', 'tBUoT5y3q9', 'yV6oqWBaS5', 'VG7oPi6Z88', 'ElPoYlRwDR', 'xHDomnhDYP', 'BTBkdRC1EA', 'AMrkv5qsnA', 'xUJket4wiQ'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, rDIp5G8onoljg2aKqn.cs	High entropy of concatenated method names: 'GyEPsNGmbc', 'AeKP60Dcmb', 'fIQPhkuffT', 'r8kP2QiRoi', 'IFOPRb9hr3', 'i8KPx6pawM', 'ab2PdaQLtM', 'uPrPvfrUkR', 'PEePey8bVA', 'yFhP5KOi9N'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, KJLWMFUAwl9EjQ3Nxn.cs	High entropy of concatenated method names: 'pPZkqFnMuO', 'gKtkPlZJyb', 'fyOkX3Ypin', 'WMOkYIcsRd', 'uD3km0phmX', 'srRkjXBgAq', 'dIKkUuJ25Y', 'TWtkGqLEyw', 'VASkCJDl12', 'IhCkHVp5fj'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, ySKAX7gAV1CMZRPs6r.cs	High entropy of concatenated method names: 'uTOXZij8dh', 'r4qX9kwnlq', 'MVWXfxGigI', 'RWUXAwx6wh', 'UvyXKw7iD5', 'fShX7Z91Y4', 'WdBXtLkiQ6', 'dD3XkrQfFf', 'u7yXoaEKFj', 'VR7XBOUxXb'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, QSK4KUc4JILpZ3IpyRw.cs	High entropy of concatenated method names: 'VpqobrK9uA', 'rlVorSeCXt', 'G2oo1iR30C', 'NwRoZvZKd9', 'nCkonvFPUF', 'iYPo9ytsxA', 'kEco8oBvIe', 'ENGofls0qS', 'VPioAKXnss', 'gDvouoKYhp'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, uXWt4EzWmqvJcLS2dM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uiloM7MHuq', 'HRwoKmJojI', 'XHpo7RKDXT', 'x7Cot2jC8d', 'TRsokBIMEX', 'eG3oonQSXG', 'rLuoB7c2V9'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, grvkySDx2bMBUo2s1j.cs	High entropy of concatenated method names: 'Ii0tvRG7t9', 'KZft53SoFD', 'mJrkN6mqCr', 'APEkJDAwXq', 'vTOtEF0RNb', 't2rtDwfmRs', 'lSAtl1Vn71', 'oRIts0p6aB', 'NGbt6cqQcm', 's3AthSjkI6'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, GJJWFJkvd2VZBSbtjl.cs	High entropy of concatenated method names: 'jn8tCKY4Ck', 'EpitHys6B7', 'ToString', 'S40tqJnNbW', 'WettPrSuU5', 'Pa5tXD9rQB', 'mwitYiioBl', 'RnXtmwNDum', 'FTrtjtw5W8', 'd0ltU7gMUm'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, A8gFw3myrZdLsbB0jH.cs	High entropy of concatenated method names: 'hGoKV6pOP2', 'sDTKD6DAZl', 'D4TKsanD9P', 'SasK63Llaa', 'WFxKLVIpSQ', 'MyXKwq2vTU', 'wNyKa0NaZX', 'etEKIpeQwt', 'A0jKFCyT2p', 'TCLKSLsBAh'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, mQ0RGZYiDcvttbn8xA.cs	High entropy of concatenated method names: 'l01MfqMb0E', 'qeHMA1vonM', 'ME5MOCN54K', 'mXbMLwjK0S', 'bAvMaMexpa', 'GqfMIdE1tK', 'TaHMSNopXT', 'x88Mi2sc0L', 'xoLMVWXQC5', 'zeBMEjCkaL'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, JtfGZgjgKQWLSBqGf3.cs	High entropy of concatenated method names: 'LbfmcoYk6u', 'MV4mPPCLnY', 'P5JmYVhp03', 'la1mjB4EAP', 'xMmmUGtyGI', 'rl5YRHNysM', 'c5OYxKt6JN', 'dbGYdNW8td', 'qmtYvMqXKX', 'frYYeddTyN'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, bTPDcirfT3DGP9qfd1.cs	High entropy of concatenated method names: 'yPwYn0ZEad', 'ckJY8sQgtx', 'X2EXw7jaGY', 'yqJXaRAPmK', 'WrNXIEehvy', 'tNsXFB1nT7', 'rpmXSEgCcO', 'Xt6XiBYCTH', 'xKBXppOemy', 'AEjXVowRsU'
Source: 0.2.RFQ 0400-ENPI-RQMA.exe.4ec4620.9.raw.unpack, MDFNbnfWwmWjgD7ikE.cs	High entropy of concatenated method names: 'EZjjbluCTR', 'rcWjrtlD8U', 'ALDj1TjIys', 'zhyjZtkuHb', 'GCQjnFDD2h', 'KUsj9EVZR5', 'c0dj8Eynfa', 'HT6jfnLUrW', 'Jk7jAleOSw', 'z0hjudJV8m'

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: RFQ 0400-ENPI-RQMA.exe PID: 7300, type: MEMORYSTR

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Memory allocated: 16A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Memory allocated: 32C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Memory allocated: 31D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Memory allocated: 9130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Memory allocated: A130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Memory allocated: A330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Memory allocated: B330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Memory allocated: B720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Memory allocated: C720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Memory allocated: D720000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Code function: 2_2_0143D1C0 rdtsc

2_2_0143D1C0

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\replace.exe	API coverage: 1.5 %

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe TID: 7320	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe TID: 8056	Thread sleep time: -70000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\replace.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Thread delayed: delay time: 922337203685477

Source: KdcHSkcpIgYD.exe, 00000008.00000002.2897904330.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT
Source: replace.exe, 00000005.00000002.2175137923.0000000002B20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Code function: 2_2_0143D1C0 rdtsc

2_2_0143D1C0

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Code function: 2_2_00417673 LdrLoadDll,

2_2_00417673

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01454144 mov eax, dword ptr fs:[00000030h]	2_2_01454144
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01454144 mov eax, dword ptr fs:[00000030h]	2_2_01454144
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01454144 mov ecx, dword ptr fs:[00000030h]	2_2_01454144
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01454144 mov eax, dword ptr fs:[00000030h]	2_2_01454144
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01454144 mov eax, dword ptr fs:[00000030h]	2_2_01454144
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01453140 mov eax, dword ptr fs:[00000030h]	2_2_01453140
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01453140 mov eax, dword ptr fs:[00000030h]	2_2_01453140
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01453140 mov eax, dword ptr fs:[00000030h]	2_2_01453140
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C1131 mov eax, dword ptr fs:[00000030h]	2_2_013C1131
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C1131 mov eax, dword ptr fs:[00000030h]	2_2_013C1131
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BB136 mov eax, dword ptr fs:[00000030h]	2_2_013BB136
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BB136 mov eax, dword ptr fs:[00000030h]	2_2_013BB136
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BB136 mov eax, dword ptr fs:[00000030h]	2_2_013BB136
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BB136 mov eax, dword ptr fs:[00000030h]	2_2_013BB136
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01495152 mov eax, dword ptr fs:[00000030h]	2_2_01495152
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F0124 mov eax, dword ptr fs:[00000030h]	2_2_013F0124
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01458158 mov eax, dword ptr fs:[00000030h]	2_2_01458158
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01459179 mov eax, dword ptr fs:[00000030h]	2_2_01459179
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BF172 mov eax, dword ptr fs:[00000030h]	2_2_013BF172
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01480115 mov eax, dword ptr fs:[00000030h]	2_2_01480115
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146A118 mov ecx, dword ptr fs:[00000030h]	2_2_0146A118
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146A118 mov eax, dword ptr fs:[00000030h]	2_2_0146A118
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146A118 mov eax, dword ptr fs:[00000030h]	2_2_0146A118
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146A118 mov eax, dword ptr fs:[00000030h]	2_2_0146A118
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C6154 mov eax, dword ptr fs:[00000030h]	2_2_013C6154
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C6154 mov eax, dword ptr fs:[00000030h]	2_2_013C6154
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BC156 mov eax, dword ptr fs:[00000030h]	2_2_013BC156
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C7152 mov eax, dword ptr fs:[00000030h]	2_2_013C7152
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B9148 mov eax, dword ptr fs:[00000030h]	2_2_013B9148
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B9148 mov eax, dword ptr fs:[00000030h]	2_2_013B9148
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B9148 mov eax, dword ptr fs:[00000030h]	2_2_013B9148
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B9148 mov eax, dword ptr fs:[00000030h]	2_2_013B9148
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014951CB mov eax, dword ptr fs:[00000030h]	2_2_014951CB
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014861C3 mov eax, dword ptr fs:[00000030h]	2_2_014861C3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014861C3 mov eax, dword ptr fs:[00000030h]	2_2_014861C3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DB1B0 mov eax, dword ptr fs:[00000030h]	2_2_013DB1B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0143E1D0 mov eax, dword ptr fs:[00000030h]	2_2_0143E1D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0143E1D0 mov eax, dword ptr fs:[00000030h]	2_2_0143E1D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0143E1D0 mov ecx, dword ptr fs:[00000030h]	2_2_0143E1D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0143E1D0 mov eax, dword ptr fs:[00000030h]	2_2_0143E1D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0143E1D0 mov eax, dword ptr fs:[00000030h]	2_2_0143E1D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BA197 mov eax, dword ptr fs:[00000030h]	2_2_013BA197
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BA197 mov eax, dword ptr fs:[00000030h]	2_2_013BA197
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BA197 mov eax, dword ptr fs:[00000030h]	2_2_013BA197
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014961E5 mov eax, dword ptr fs:[00000030h]	2_2_014961E5
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014671F9 mov esi, dword ptr fs:[00000030h]	2_2_014671F9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01400185 mov eax, dword ptr fs:[00000030h]	2_2_01400185
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F01F8 mov eax, dword ptr fs:[00000030h]	2_2_013F01F8
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147C188 mov eax, dword ptr fs:[00000030h]	2_2_0147C188
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147C188 mov eax, dword ptr fs:[00000030h]	2_2_0147C188
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E51EF mov eax, dword ptr fs:[00000030h]	2_2_013E51EF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C51ED mov eax, dword ptr fs:[00000030h]	2_2_013C51ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01417190 mov eax, dword ptr fs:[00000030h]	2_2_01417190
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144019F mov eax, dword ptr fs:[00000030h]	2_2_0144019F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144019F mov eax, dword ptr fs:[00000030h]	2_2_0144019F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144019F mov eax, dword ptr fs:[00000030h]	2_2_0144019F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144019F mov eax, dword ptr fs:[00000030h]	2_2_0144019F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014711A4 mov eax, dword ptr fs:[00000030h]	2_2_014711A4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014711A4 mov eax, dword ptr fs:[00000030h]	2_2_014711A4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014711A4 mov eax, dword ptr fs:[00000030h]	2_2_014711A4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014711A4 mov eax, dword ptr fs:[00000030h]	2_2_014711A4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FD1D0 mov eax, dword ptr fs:[00000030h]	2_2_013FD1D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FD1D0 mov ecx, dword ptr fs:[00000030h]	2_2_013FD1D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01446050 mov eax, dword ptr fs:[00000030h]	2_2_01446050
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146705E mov ebx, dword ptr fs:[00000030h]	2_2_0146705E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146705E mov eax, dword ptr fs:[00000030h]	2_2_0146705E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BA020 mov eax, dword ptr fs:[00000030h]	2_2_013BA020
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BC020 mov eax, dword ptr fs:[00000030h]	2_2_013BC020
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01495060 mov eax, dword ptr fs:[00000030h]	2_2_01495060
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144106E mov eax, dword ptr fs:[00000030h]	2_2_0144106E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DE016 mov eax, dword ptr fs:[00000030h]	2_2_013DE016
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DE016 mov eax, dword ptr fs:[00000030h]	2_2_013DE016
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DE016 mov eax, dword ptr fs:[00000030h]	2_2_013DE016
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DE016 mov eax, dword ptr fs:[00000030h]	2_2_013DE016
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0143D070 mov ecx, dword ptr fs:[00000030h]	2_2_0143D070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01444000 mov ecx, dword ptr fs:[00000030h]	2_2_01444000
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov ecx, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D1070 mov eax, dword ptr fs:[00000030h]	2_2_013D1070
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EC073 mov eax, dword ptr fs:[00000030h]	2_2_013EC073
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C2050 mov eax, dword ptr fs:[00000030h]	2_2_013C2050
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EB052 mov eax, dword ptr fs:[00000030h]	2_2_013EB052
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01456030 mov eax, dword ptr fs:[00000030h]	2_2_01456030
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148903E mov eax, dword ptr fs:[00000030h]	2_2_0148903E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148903E mov eax, dword ptr fs:[00000030h]	2_2_0148903E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148903E mov eax, dword ptr fs:[00000030h]	2_2_0148903E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148903E mov eax, dword ptr fs:[00000030h]	2_2_0148903E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0143D0C0 mov eax, dword ptr fs:[00000030h]	2_2_0143D0C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0143D0C0 mov eax, dword ptr fs:[00000030h]	2_2_0143D0C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014950D9 mov eax, dword ptr fs:[00000030h]	2_2_014950D9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014420DE mov eax, dword ptr fs:[00000030h]	2_2_014420DE
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F909C mov eax, dword ptr fs:[00000030h]	2_2_013F909C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014460E0 mov eax, dword ptr fs:[00000030h]	2_2_014460E0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C5096 mov eax, dword ptr fs:[00000030h]	2_2_013C5096
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013ED090 mov eax, dword ptr fs:[00000030h]	2_2_013ED090
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013ED090 mov eax, dword ptr fs:[00000030h]	2_2_013ED090
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014020F0 mov ecx, dword ptr fs:[00000030h]	2_2_014020F0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C208A mov eax, dword ptr fs:[00000030h]	2_2_013C208A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BD08D mov eax, dword ptr fs:[00000030h]	2_2_013BD08D
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144D080 mov eax, dword ptr fs:[00000030h]	2_2_0144D080
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144D080 mov eax, dword ptr fs:[00000030h]	2_2_0144D080
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BC0F0 mov eax, dword ptr fs:[00000030h]	2_2_013BC0F0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C80E9 mov eax, dword ptr fs:[00000030h]	2_2_013C80E9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BA0E3 mov ecx, dword ptr fs:[00000030h]	2_2_013BA0E3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E50E4 mov eax, dword ptr fs:[00000030h]	2_2_013E50E4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E50E4 mov ecx, dword ptr fs:[00000030h]	2_2_013E50E4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E90DB mov eax, dword ptr fs:[00000030h]	2_2_013E90DB
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014580A8 mov eax, dword ptr fs:[00000030h]	2_2_014580A8
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014860B8 mov eax, dword ptr fs:[00000030h]	2_2_014860B8
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014860B8 mov ecx, dword ptr fs:[00000030h]	2_2_014860B8
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov ecx, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov ecx, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov ecx, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov ecx, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D70C0 mov eax, dword ptr fs:[00000030h]	2_2_013D70C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01495341 mov eax, dword ptr fs:[00000030h]	2_2_01495341
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B7330 mov eax, dword ptr fs:[00000030h]	2_2_013B7330
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01442349 mov eax, dword ptr fs:[00000030h]	2_2_01442349
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF32A mov eax, dword ptr fs:[00000030h]	2_2_013EF32A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144035C mov eax, dword ptr fs:[00000030h]	2_2_0144035C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144035C mov eax, dword ptr fs:[00000030h]	2_2_0144035C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144035C mov eax, dword ptr fs:[00000030h]	2_2_0144035C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144035C mov ecx, dword ptr fs:[00000030h]	2_2_0144035C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144035C mov eax, dword ptr fs:[00000030h]	2_2_0144035C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144035C mov eax, dword ptr fs:[00000030h]	2_2_0144035C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148A352 mov eax, dword ptr fs:[00000030h]	2_2_0148A352
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147F367 mov eax, dword ptr fs:[00000030h]	2_2_0147F367
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BC310 mov ecx, dword ptr fs:[00000030h]	2_2_013BC310
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E0310 mov ecx, dword ptr fs:[00000030h]	2_2_013E0310
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FA30B mov eax, dword ptr fs:[00000030h]	2_2_013FA30B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FA30B mov eax, dword ptr fs:[00000030h]	2_2_013FA30B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FA30B mov eax, dword ptr fs:[00000030h]	2_2_013FA30B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146437C mov eax, dword ptr fs:[00000030h]	2_2_0146437C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C7370 mov eax, dword ptr fs:[00000030h]	2_2_013C7370
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C7370 mov eax, dword ptr fs:[00000030h]	2_2_013C7370
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C7370 mov eax, dword ptr fs:[00000030h]	2_2_013C7370
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144930B mov eax, dword ptr fs:[00000030h]	2_2_0144930B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144930B mov eax, dword ptr fs:[00000030h]	2_2_0144930B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144930B mov eax, dword ptr fs:[00000030h]	2_2_0144930B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148132D mov eax, dword ptr fs:[00000030h]	2_2_0148132D
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148132D mov eax, dword ptr fs:[00000030h]	2_2_0148132D
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B9353 mov eax, dword ptr fs:[00000030h]	2_2_013B9353
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B9353 mov eax, dword ptr fs:[00000030h]	2_2_013B9353
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BD34C mov eax, dword ptr fs:[00000030h]	2_2_013BD34C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BD34C mov eax, dword ptr fs:[00000030h]	2_2_013BD34C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014463C0 mov eax, dword ptr fs:[00000030h]	2_2_014463C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147C3CD mov eax, dword ptr fs:[00000030h]	2_2_0147C3CD
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147B3D0 mov ecx, dword ptr fs:[00000030h]	2_2_0147B3D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E33A5 mov eax, dword ptr fs:[00000030h]	2_2_013E33A5
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F33A0 mov eax, dword ptr fs:[00000030h]	2_2_013F33A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F33A0 mov eax, dword ptr fs:[00000030h]	2_2_013F33A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147F3E6 mov eax, dword ptr fs:[00000030h]	2_2_0147F3E6
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B8397 mov eax, dword ptr fs:[00000030h]	2_2_013B8397
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B8397 mov eax, dword ptr fs:[00000030h]	2_2_013B8397
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B8397 mov eax, dword ptr fs:[00000030h]	2_2_013B8397
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E438F mov eax, dword ptr fs:[00000030h]	2_2_013E438F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E438F mov eax, dword ptr fs:[00000030h]	2_2_013E438F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BE388 mov eax, dword ptr fs:[00000030h]	2_2_013BE388
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BE388 mov eax, dword ptr fs:[00000030h]	2_2_013BE388
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BE388 mov eax, dword ptr fs:[00000030h]	2_2_013BE388
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014953FC mov eax, dword ptr fs:[00000030h]	2_2_014953FC
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F63FF mov eax, dword ptr fs:[00000030h]	2_2_013F63FF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DE3F0 mov eax, dword ptr fs:[00000030h]	2_2_013DE3F0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DE3F0 mov eax, dword ptr fs:[00000030h]	2_2_013DE3F0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DE3F0 mov eax, dword ptr fs:[00000030h]	2_2_013DE3F0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0149539D mov eax, dword ptr fs:[00000030h]	2_2_0149539D
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D03E9 mov eax, dword ptr fs:[00000030h]	2_2_013D03E9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D03E9 mov eax, dword ptr fs:[00000030h]	2_2_013D03E9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D03E9 mov eax, dword ptr fs:[00000030h]	2_2_013D03E9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D03E9 mov eax, dword ptr fs:[00000030h]	2_2_013D03E9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D03E9 mov eax, dword ptr fs:[00000030h]	2_2_013D03E9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D03E9 mov eax, dword ptr fs:[00000030h]	2_2_013D03E9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D03E9 mov eax, dword ptr fs:[00000030h]	2_2_013D03E9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D03E9 mov eax, dword ptr fs:[00000030h]	2_2_013D03E9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0141739A mov eax, dword ptr fs:[00000030h]	2_2_0141739A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0141739A mov eax, dword ptr fs:[00000030h]	2_2_0141739A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_013CA3C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_013CA3C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_013CA3C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_013CA3C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_013CA3C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_013CA3C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C83C0 mov eax, dword ptr fs:[00000030h]	2_2_013C83C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C83C0 mov eax, dword ptr fs:[00000030h]	2_2_013C83C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C83C0 mov eax, dword ptr fs:[00000030h]	2_2_013C83C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C83C0 mov eax, dword ptr fs:[00000030h]	2_2_013C83C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B823B mov eax, dword ptr fs:[00000030h]	2_2_013B823B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01448243 mov eax, dword ptr fs:[00000030h]	2_2_01448243
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01448243 mov ecx, dword ptr fs:[00000030h]	2_2_01448243
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147B256 mov eax, dword ptr fs:[00000030h]	2_2_0147B256
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147B256 mov eax, dword ptr fs:[00000030h]	2_2_0147B256
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148D26B mov eax, dword ptr fs:[00000030h]	2_2_0148D26B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0148D26B mov eax, dword ptr fs:[00000030h]	2_2_0148D26B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01401270 mov eax, dword ptr fs:[00000030h]	2_2_01401270
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01401270 mov eax, dword ptr fs:[00000030h]	2_2_01401270
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01470274 mov eax, dword ptr fs:[00000030h]	2_2_01470274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F7208 mov eax, dword ptr fs:[00000030h]	2_2_013F7208
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F7208 mov eax, dword ptr fs:[00000030h]	2_2_013F7208
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E9274 mov eax, dword ptr fs:[00000030h]	2_2_013E9274
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B826B mov eax, dword ptr fs:[00000030h]	2_2_013B826B
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C4260 mov eax, dword ptr fs:[00000030h]	2_2_013C4260
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C4260 mov eax, dword ptr fs:[00000030h]	2_2_013C4260
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C4260 mov eax, dword ptr fs:[00000030h]	2_2_013C4260
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C6259 mov eax, dword ptr fs:[00000030h]	2_2_013C6259
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BA250 mov eax, dword ptr fs:[00000030h]	2_2_013BA250
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01495227 mov eax, dword ptr fs:[00000030h]	2_2_01495227
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F724D mov eax, dword ptr fs:[00000030h]	2_2_013F724D
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B9240 mov eax, dword ptr fs:[00000030h]	2_2_013B9240
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B9240 mov eax, dword ptr fs:[00000030h]	2_2_013B9240
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D02A0 mov eax, dword ptr fs:[00000030h]	2_2_013D02A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D02A0 mov eax, dword ptr fs:[00000030h]	2_2_013D02A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D52A0 mov eax, dword ptr fs:[00000030h]	2_2_013D52A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D52A0 mov eax, dword ptr fs:[00000030h]	2_2_013D52A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D52A0 mov eax, dword ptr fs:[00000030h]	2_2_013D52A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D52A0 mov eax, dword ptr fs:[00000030h]	2_2_013D52A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F329E mov eax, dword ptr fs:[00000030h]	2_2_013F329E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F329E mov eax, dword ptr fs:[00000030h]	2_2_013F329E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014712ED mov eax, dword ptr fs:[00000030h]	2_2_014712ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014952E2 mov eax, dword ptr fs:[00000030h]	2_2_014952E2
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FE284 mov eax, dword ptr fs:[00000030h]	2_2_013FE284
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FE284 mov eax, dword ptr fs:[00000030h]	2_2_013FE284
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147F2F8 mov eax, dword ptr fs:[00000030h]	2_2_0147F2F8
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B92FF mov eax, dword ptr fs:[00000030h]	2_2_013B92FF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01440283 mov eax, dword ptr fs:[00000030h]	2_2_01440283
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01440283 mov eax, dword ptr fs:[00000030h]	2_2_01440283
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01440283 mov eax, dword ptr fs:[00000030h]	2_2_01440283
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01495283 mov eax, dword ptr fs:[00000030h]	2_2_01495283
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D02E1 mov eax, dword ptr fs:[00000030h]	2_2_013D02E1
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D02E1 mov eax, dword ptr fs:[00000030h]	2_2_013D02E1
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D02E1 mov eax, dword ptr fs:[00000030h]	2_2_013D02E1
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014562A0 mov eax, dword ptr fs:[00000030h]	2_2_014562A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014562A0 mov ecx, dword ptr fs:[00000030h]	2_2_014562A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014562A0 mov eax, dword ptr fs:[00000030h]	2_2_014562A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014562A0 mov eax, dword ptr fs:[00000030h]	2_2_014562A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014562A0 mov eax, dword ptr fs:[00000030h]	2_2_014562A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014562A0 mov eax, dword ptr fs:[00000030h]	2_2_014562A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014572A0 mov eax, dword ptr fs:[00000030h]	2_2_014572A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014572A0 mov eax, dword ptr fs:[00000030h]	2_2_014572A0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BB2D3 mov eax, dword ptr fs:[00000030h]	2_2_013BB2D3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BB2D3 mov eax, dword ptr fs:[00000030h]	2_2_013BB2D3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BB2D3 mov eax, dword ptr fs:[00000030h]	2_2_013BB2D3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF2D0 mov eax, dword ptr fs:[00000030h]	2_2_013EF2D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF2D0 mov eax, dword ptr fs:[00000030h]	2_2_013EF2D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014892A6 mov eax, dword ptr fs:[00000030h]	2_2_014892A6
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014892A6 mov eax, dword ptr fs:[00000030h]	2_2_014892A6
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014892A6 mov eax, dword ptr fs:[00000030h]	2_2_014892A6
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014892A6 mov eax, dword ptr fs:[00000030h]	2_2_014892A6
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014492BC mov eax, dword ptr fs:[00000030h]	2_2_014492BC
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014492BC mov eax, dword ptr fs:[00000030h]	2_2_014492BC
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014492BC mov ecx, dword ptr fs:[00000030h]	2_2_014492BC
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014492BC mov ecx, dword ptr fs:[00000030h]	2_2_014492BC
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C92C5 mov eax, dword ptr fs:[00000030h]	2_2_013C92C5
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C92C5 mov eax, dword ptr fs:[00000030h]	2_2_013C92C5
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EB2C0 mov eax, dword ptr fs:[00000030h]	2_2_013EB2C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EB2C0 mov eax, dword ptr fs:[00000030h]	2_2_013EB2C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EB2C0 mov eax, dword ptr fs:[00000030h]	2_2_013EB2C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EB2C0 mov eax, dword ptr fs:[00000030h]	2_2_013EB2C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EB2C0 mov eax, dword ptr fs:[00000030h]	2_2_013EB2C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EB2C0 mov eax, dword ptr fs:[00000030h]	2_2_013EB2C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EB2C0 mov eax, dword ptr fs:[00000030h]	2_2_013EB2C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CA2C3 mov eax, dword ptr fs:[00000030h]	2_2_013CA2C3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CA2C3 mov eax, dword ptr fs:[00000030h]	2_2_013CA2C3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CA2C3 mov eax, dword ptr fs:[00000030h]	2_2_013CA2C3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CA2C3 mov eax, dword ptr fs:[00000030h]	2_2_013CA2C3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CA2C3 mov eax, dword ptr fs:[00000030h]	2_2_013CA2C3
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE53E mov eax, dword ptr fs:[00000030h]	2_2_013EE53E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE53E mov eax, dword ptr fs:[00000030h]	2_2_013EE53E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE53E mov eax, dword ptr fs:[00000030h]	2_2_013EE53E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE53E mov eax, dword ptr fs:[00000030h]	2_2_013EE53E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE53E mov eax, dword ptr fs:[00000030h]	2_2_013EE53E
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D0535 mov eax, dword ptr fs:[00000030h]	2_2_013D0535
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D0535 mov eax, dword ptr fs:[00000030h]	2_2_013D0535
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D0535 mov eax, dword ptr fs:[00000030h]	2_2_013D0535
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D0535 mov eax, dword ptr fs:[00000030h]	2_2_013D0535
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D0535 mov eax, dword ptr fs:[00000030h]	2_2_013D0535
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013D0535 mov eax, dword ptr fs:[00000030h]	2_2_013D0535
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CD534 mov eax, dword ptr fs:[00000030h]	2_2_013CD534
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CD534 mov eax, dword ptr fs:[00000030h]	2_2_013CD534
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CD534 mov eax, dword ptr fs:[00000030h]	2_2_013CD534
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CD534 mov eax, dword ptr fs:[00000030h]	2_2_013CD534
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CD534 mov eax, dword ptr fs:[00000030h]	2_2_013CD534
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013CD534 mov eax, dword ptr fs:[00000030h]	2_2_013CD534
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FD530 mov eax, dword ptr fs:[00000030h]	2_2_013FD530
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FD530 mov eax, dword ptr fs:[00000030h]	2_2_013FD530
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F7505 mov eax, dword ptr fs:[00000030h]	2_2_013F7505
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F7505 mov ecx, dword ptr fs:[00000030h]	2_2_013F7505
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01456500 mov eax, dword ptr fs:[00000030h]	2_2_01456500
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01494500 mov eax, dword ptr fs:[00000030h]	2_2_01494500
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01494500 mov eax, dword ptr fs:[00000030h]	2_2_01494500
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01494500 mov eax, dword ptr fs:[00000030h]	2_2_01494500
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01494500 mov eax, dword ptr fs:[00000030h]	2_2_01494500
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01494500 mov eax, dword ptr fs:[00000030h]	2_2_01494500
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01494500 mov eax, dword ptr fs:[00000030h]	2_2_01494500
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01494500 mov eax, dword ptr fs:[00000030h]	2_2_01494500
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FB570 mov eax, dword ptr fs:[00000030h]	2_2_013FB570
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FB570 mov eax, dword ptr fs:[00000030h]	2_2_013FB570
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F656A mov eax, dword ptr fs:[00000030h]	2_2_013F656A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F656A mov eax, dword ptr fs:[00000030h]	2_2_013F656A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F656A mov eax, dword ptr fs:[00000030h]	2_2_013F656A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BB562 mov eax, dword ptr fs:[00000030h]	2_2_013BB562
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146F525 mov eax, dword ptr fs:[00000030h]	2_2_0146F525
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146F525 mov eax, dword ptr fs:[00000030h]	2_2_0146F525
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146F525 mov eax, dword ptr fs:[00000030h]	2_2_0146F525
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146F525 mov eax, dword ptr fs:[00000030h]	2_2_0146F525
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146F525 mov eax, dword ptr fs:[00000030h]	2_2_0146F525
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146F525 mov eax, dword ptr fs:[00000030h]	2_2_0146F525
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0146F525 mov eax, dword ptr fs:[00000030h]	2_2_0146F525
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147B52F mov eax, dword ptr fs:[00000030h]	2_2_0147B52F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C8550 mov eax, dword ptr fs:[00000030h]	2_2_013C8550
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C8550 mov eax, dword ptr fs:[00000030h]	2_2_013C8550
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01495537 mov eax, dword ptr fs:[00000030h]	2_2_01495537
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014955C9 mov eax, dword ptr fs:[00000030h]	2_2_014955C9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF5B0 mov eax, dword ptr fs:[00000030h]	2_2_013EF5B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF5B0 mov eax, dword ptr fs:[00000030h]	2_2_013EF5B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF5B0 mov eax, dword ptr fs:[00000030h]	2_2_013EF5B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF5B0 mov eax, dword ptr fs:[00000030h]	2_2_013EF5B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF5B0 mov eax, dword ptr fs:[00000030h]	2_2_013EF5B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF5B0 mov eax, dword ptr fs:[00000030h]	2_2_013EF5B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF5B0 mov eax, dword ptr fs:[00000030h]	2_2_013EF5B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF5B0 mov eax, dword ptr fs:[00000030h]	2_2_013EF5B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EF5B0 mov eax, dword ptr fs:[00000030h]	2_2_013EF5B0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E45B1 mov eax, dword ptr fs:[00000030h]	2_2_013E45B1
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E45B1 mov eax, dword ptr fs:[00000030h]	2_2_013E45B1
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0143D5D0 mov eax, dword ptr fs:[00000030h]	2_2_0143D5D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0143D5D0 mov ecx, dword ptr fs:[00000030h]	2_2_0143D5D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E15A9 mov eax, dword ptr fs:[00000030h]	2_2_013E15A9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E15A9 mov eax, dword ptr fs:[00000030h]	2_2_013E15A9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E15A9 mov eax, dword ptr fs:[00000030h]	2_2_013E15A9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E15A9 mov eax, dword ptr fs:[00000030h]	2_2_013E15A9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E15A9 mov eax, dword ptr fs:[00000030h]	2_2_013E15A9
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014935D7 mov eax, dword ptr fs:[00000030h]	2_2_014935D7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014935D7 mov eax, dword ptr fs:[00000030h]	2_2_014935D7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014935D7 mov eax, dword ptr fs:[00000030h]	2_2_014935D7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FE59C mov eax, dword ptr fs:[00000030h]	2_2_013FE59C
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B758F mov eax, dword ptr fs:[00000030h]	2_2_013B758F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B758F mov eax, dword ptr fs:[00000030h]	2_2_013B758F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013B758F mov eax, dword ptr fs:[00000030h]	2_2_013B758F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F4588 mov eax, dword ptr fs:[00000030h]	2_2_013F4588
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C2582 mov eax, dword ptr fs:[00000030h]	2_2_013C2582
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C2582 mov ecx, dword ptr fs:[00000030h]	2_2_013C2582
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E15F4 mov eax, dword ptr fs:[00000030h]	2_2_013E15F4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E15F4 mov eax, dword ptr fs:[00000030h]	2_2_013E15F4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E15F4 mov eax, dword ptr fs:[00000030h]	2_2_013E15F4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E15F4 mov eax, dword ptr fs:[00000030h]	2_2_013E15F4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E15F4 mov eax, dword ptr fs:[00000030h]	2_2_013E15F4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E15F4 mov eax, dword ptr fs:[00000030h]	2_2_013E15F4
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144B594 mov eax, dword ptr fs:[00000030h]	2_2_0144B594
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144B594 mov eax, dword ptr fs:[00000030h]	2_2_0144B594
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FC5ED mov eax, dword ptr fs:[00000030h]	2_2_013FC5ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FC5ED mov eax, dword ptr fs:[00000030h]	2_2_013FC5ED
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_013EE5E7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_013EE5E7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_013EE5E7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_013EE5E7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_013EE5E7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_013EE5E7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_013EE5E7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_013EE5E7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C25E0 mov eax, dword ptr fs:[00000030h]	2_2_013C25E0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014405A7 mov eax, dword ptr fs:[00000030h]	2_2_014405A7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014405A7 mov eax, dword ptr fs:[00000030h]	2_2_014405A7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014405A7 mov eax, dword ptr fs:[00000030h]	2_2_014405A7
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E95DA mov eax, dword ptr fs:[00000030h]	2_2_013E95DA
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C65D0 mov eax, dword ptr fs:[00000030h]	2_2_013C65D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FA5D0 mov eax, dword ptr fs:[00000030h]	2_2_013FA5D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FA5D0 mov eax, dword ptr fs:[00000030h]	2_2_013FA5D0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FE5CF mov eax, dword ptr fs:[00000030h]	2_2_013FE5CF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013FE5CF mov eax, dword ptr fs:[00000030h]	2_2_013FE5CF
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147F5BE mov eax, dword ptr fs:[00000030h]	2_2_0147F5BE
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014535BA mov eax, dword ptr fs:[00000030h]	2_2_014535BA
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014535BA mov eax, dword ptr fs:[00000030h]	2_2_014535BA
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014535BA mov eax, dword ptr fs:[00000030h]	2_2_014535BA
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_014535BA mov eax, dword ptr fs:[00000030h]	2_2_014535BA
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F55C0 mov eax, dword ptr fs:[00000030h]	2_2_013F55C0
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0147F453 mov eax, dword ptr fs:[00000030h]	2_2_0147F453
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BE420 mov eax, dword ptr fs:[00000030h]	2_2_013BE420
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BE420 mov eax, dword ptr fs:[00000030h]	2_2_013BE420
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BE420 mov eax, dword ptr fs:[00000030h]	2_2_013BE420
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013BC427 mov eax, dword ptr fs:[00000030h]	2_2_013BC427
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0144C460 mov ecx, dword ptr fs:[00000030h]	2_2_0144C460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E340D mov eax, dword ptr fs:[00000030h]	2_2_013E340D
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_0149547F mov eax, dword ptr fs:[00000030h]	2_2_0149547F
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F8402 mov eax, dword ptr fs:[00000030h]	2_2_013F8402
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F8402 mov eax, dword ptr fs:[00000030h]	2_2_013F8402
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013F8402 mov eax, dword ptr fs:[00000030h]	2_2_013F8402
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EA470 mov eax, dword ptr fs:[00000030h]	2_2_013EA470
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EA470 mov eax, dword ptr fs:[00000030h]	2_2_013EA470
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013EA470 mov eax, dword ptr fs:[00000030h]	2_2_013EA470
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01447410 mov eax, dword ptr fs:[00000030h]	2_2_01447410
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C1460 mov eax, dword ptr fs:[00000030h]	2_2_013C1460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C1460 mov eax, dword ptr fs:[00000030h]	2_2_013C1460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C1460 mov eax, dword ptr fs:[00000030h]	2_2_013C1460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C1460 mov eax, dword ptr fs:[00000030h]	2_2_013C1460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013C1460 mov eax, dword ptr fs:[00000030h]	2_2_013C1460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DF460 mov eax, dword ptr fs:[00000030h]	2_2_013DF460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DF460 mov eax, dword ptr fs:[00000030h]	2_2_013DF460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DF460 mov eax, dword ptr fs:[00000030h]	2_2_013DF460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DF460 mov eax, dword ptr fs:[00000030h]	2_2_013DF460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DF460 mov eax, dword ptr fs:[00000030h]	2_2_013DF460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013DF460 mov eax, dword ptr fs:[00000030h]	2_2_013DF460
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_013E245A mov eax, dword ptr fs:[00000030h]	2_2_013E245A
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01446420 mov eax, dword ptr fs:[00000030h]	2_2_01446420
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01446420 mov eax, dword ptr fs:[00000030h]	2_2_01446420
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01446420 mov eax, dword ptr fs:[00000030h]	2_2_01446420
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01446420 mov eax, dword ptr fs:[00000030h]	2_2_01446420
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01446420 mov eax, dword ptr fs:[00000030h]	2_2_01446420
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Code function: 2_2_01446420 mov eax, dword ptr fs:[00000030h]	2_2_01446420

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Memory allocated: page read and write | page guard

Found direct / indirect Syscall (likely to bypass EDR)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Memory written: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: NULL target: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Section loaded: NULL target: C:\Windows\SysWOW64\replace.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: NULL target: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: NULL target: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\replace.exe

Thread APC queued: target process: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Process created: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe "C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe"	Jump to behavior
Source: C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe	Process created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: KdcHSkcpIgYD.exe, 00000004.00000000.1853836603.00000000015A1000.00000002.00000001.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000002.2895817745.00000000015A0000.00000002.00000001.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000000.1995433621.0000000000E71000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: KdcHSkcpIgYD.exe, 00000004.00000000.1853836603.00000000015A1000.00000002.00000001.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000002.2895817745.00000000015A0000.00000002.00000001.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000000.1995433621.0000000000E71000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: KdcHSkcpIgYD.exe, 00000004.00000000.1853836603.00000000015A1000.00000002.00000001.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000002.2895817745.00000000015A0000.00000002.00000001.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000000.1995433621.0000000000E71000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: KdcHSkcpIgYD.exe, 00000004.00000000.1853836603.00000000015A1000.00000002.00000001.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000004.00000002.2895817745.00000000015A0000.00000002.00000001.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000000.1995433621.0000000000E71000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1927201157.0000000001300000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1926547005.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2175893456.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2175933717.0000000003020000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2913084591.0000000004B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1928973003.00000000017E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2896021580.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\replace.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ 0400-ENPI-RQMA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1927201157.0000000001300000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1926547005.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2175893456.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2175933717.0000000003020000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2913084591.0000000004B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1928973003.00000000017E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2896021580.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	312 Process Injection	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ 0400-ENPI-RQMA.exe	29%	ReversingLabs	Win32.Trojan.Generic
RFQ 0400-ENPI-RQMA.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://tempuri.org/DataSet1.xsd	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://www.sakkal.comar	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.maxiwalls.com	79.98.25.1	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.iv.lt/header.html	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/DataSet1.xsd	RFQ 0400-ENPI-RQMA.exe	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.iv.lt/domenai/	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.sajatypeworks.com	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.comar	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661760268.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.iv.lt/default.css	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.iv.lt/images/icon.png	firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
https://assets.iv.lt/images/thumbnail.png	firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.iv.lt/duomenu-centras/	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.iv.lt/profesionalus-hostingas/	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.iv.lt/talpinimo-planai/	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.iv.lt/footer.html	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.iv.lt/neribotas-svetainiu-talpinimas/	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
https://www.iv.lt/	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
https://www.iv.lt/svetainiu-kurimo-irankis/	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	RFQ 0400-ENPI-RQMA.exe	false	URL Reputation: safe	unknown
https://www.iv.lt/el-pasto-filtras/	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.carterandcone.coml	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iv.lt/vps-serveriai/	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	RFQ 0400-ENPI-RQMA.exe, 00000000.00000002.1661786243.00000000073C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klientams.iv.lt/	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	replace.exe, 00000005.00000003.2112503982.0000000007BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.iv.lt/sertifikatai/	replace.exe, 00000005.00000002.2176359316.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, KdcHSkcpIgYD.exe, 00000008.00000002.2898333907.0000000002B04000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2892020444.0000000001794000.00000004.80000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
79.98.25.1	www.maxiwalls.com	Lithuania		62282	RACKRAYUABRakrejusLT	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430324
Start date and time:	2024-04-23 14:22:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ 0400-ENPI-RQMA.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@1/1
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 84% Number of executed functions: 121 Number of non-executed functions: 259
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
VT rate limit hit for: RFQ 0400-ENPI-RQMA.exe

Simulations

Behavior and APIs

Time	Type	Description
14:22:53	API Interceptor	1x Sleep call for process: RFQ 0400-ENPI-RQMA.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
79.98.25.1	International Bank Transfer.exe	Get hash	malicious	FormBook	Browse	www.noxnoxhome.com/ve92/?KVvTZtEp=3Lb7GTp0i1UWz50Z1NTpZr264EbzejLIOiMk55K1X/ijp3vnWUvEjglcNSm79P5Sc0NLZLCPEw==&ixo=GL0X
	International Bank transfer.exe	Get hash	malicious	FormBook	Browse	www.noxnoxhome.com/ve92/?UTU=yvUt0Xc&NtBTjpl=3Lb7GTp0i1UWz50Z1NTpZr264EbzejLIOiMk55K1X/ijp3vnWUvEjglcNReS0v1pTCwd
	00726736625241525.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.christmatoy.com/6qne/?T6d7v=45MeeAD4Y8e2mqpq44/Fvp9d3MZR+OOgjBrZQamPfzy89FNMTy66VAy6fvepqGkhnz/kvI1ROEM4MGyKOy/C+oTtjVbLxPInHRTKy1tLVwIe&P9I=5Nqp
	Ekli_fatura.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.christmatoy.com/6qne/?a_=u7nXv&67=45MeeAD4Y8e2mqpq44/Fvp9d3MZR+OOgjBrZQamPfzy89FNMTy66VAy6fvepqGkhnz/kvI1ROEM4MGyKOy/CzKXxpHTL6/QrDg==
	00023134214252615.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.christmatoy.com/6qne/?0hnL5J=45MeeAD4Y8e2mqpq44/Fvp9d3MZR+OOgjBrZQamPfzy89FNMTy66VAy6fvepqGkhnz/kvI1ROEM4MGyKOy/BqbXsjSn19dkaRA==&1d=iNJ5G
	Kopija_bankovne_uplate.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.christmatoy.com/6qne/?ibHgv7=x5rx0ZN3oO-G&wO8WV=45MeeAD4Y8e2mqpq44/Fvp9d3MZR+OOgjBrZQamPfzy89FNMTy66VAy6fvepqGkhnz/kvI1ROEM4MGyKOy/C+oTtjVbLxPInHRTKy1tLVwIe
	003786546788765.PDF.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.christmatoy.com/6qne/?F_4=9SV3rDO4hnDB&U3mb=45MeeAD4Y8e2mqpq44/Fvp9d3MZR+OOgjBrZQamPfzy89FNMTy66VAy6fvepqGkhnz/kvI1ROEM4MGyKOy/Bqbjoiin18dsOQQ==
	Copie_de_plata_bancara.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.christmatoy.com/6qne/?ILqh=0AsVJSkSvC6-W&yRBmiBA-=45MeeAD4Y8e2mqpl94/vp49GzIZF/JSgjBrZQamPfzy89FNMTy66VAy6fvepqGkhnz/kvI1ROEM4MGyKOy/BqZm0t1L18dsSRA==
	U_prilogu_je_predracun.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.christmatoy.com/6qne/?fk0=89DiTmjnfCUhvYsc&kJZ5QC=45MeeAD4Y8e2mqpq44/Fvp9d3MZR+OOgjBrZQamPfzy89FNMTy66VAy6fvepqGkhnz/kvI1ROEM4MGyKOy/CzKXxpHTL6/QrDg==
	Iqgbhvnaowuspb.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.christmatoy.com/6qne/?D15HD=_t_lMOKbpZu3O9&9WZHdBH=45MeeAD4Y8e2mqpq44/Fvp9d3MZR+OOgjBrZQamPfzy89FNMTy66VAy6fvepqGkhnz/kvI1ROEM4MGyKOy/CzITtjVbGwuQSRA==

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.maxiwalls.com	INQ No.KP-50-000-PS-IN-INQ-0027.exe	Get hash	malicious	FormBook	Browse	79.98.25.1
www.maxiwalls.com	HYCO_Invoices MS2 & MS3.exe	Get hash	malicious	FormBook	Browse	79.98.25.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RACKRAYUABRakrejusLT	INQ No.KP-50-000-PS-IN-INQ-0027.exe	Get hash	malicious	FormBook	Browse	79.98.25.1
	NQYYUvHu8f.exe	Get hash	malicious	CobaltStrike	Browse	195.181.245.38
	HYCO_Invoices MS2 & MS3.exe	Get hash	malicious	FormBook	Browse	79.98.25.1
	payment form.doc.bat.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	185.5.53.18
	International Bank Transfer.exe	Get hash	malicious	FormBook	Browse	79.98.25.1
	International Bank transfer.exe	Get hash	malicious	FormBook	Browse	79.98.25.1
	4df902f11590d27189e9113ed654b0481.msi	Get hash	malicious	Unknown	Browse	212.24.99.48
	IMG001.exe	Get hash	malicious	Xmrig	Browse	62.77.152.0
	S23UhdW5DH.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	194.135.86.146
	l3fh0T2H1h.exe	Get hash	malicious	BazaLoader, SmokeLoader	Browse	80.209.233.177

Process:	C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.352427679901606
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPE4KMRuAE4KzecKIE4oKNzKorE4x84j:MIHK5HKH1qHiYHKh3oPHKMRuAHKzectP
MD5:	3978978DE913FD1C068312697D6E5917
SHA1:	1DABBE7FB8F38F6EBF474CE5F0ECAA89F48E2538
SHA-256:	33B7B1668DDD3AB39711F9F93B667F6F2F674348A79228BFA163BA625B37F120
SHA-512:	78694B97F5D03758F503155E5CE5B85AABDF9690F0DFBC51FCE9926BE2D86BCF99E008659420F1E8489A7F6EA125F2776D4C6DC4B151566B529454512352953D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll"

C:\Users\user\AppData\Local\Temp\C3vB7APK

Download File

Process:	C:\Windows\SysWOW64\replace.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9566192932571385
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RFQ 0400-ENPI-RQMA.exe
File size:	723'464 bytes
MD5:	73b6e5a11aff9e7bd681b55136c5fbcf
SHA1:	d8113fa2bd2b2fa43f3920b93f9a5217b9cb69a2
SHA256:	3ca71ea7d01b1f1e3613781fcd68b47c09a159af5876c134065bef4d912917a6
SHA512:	6450875cf74a6992dac1b880f510a2b46c04978b808e94c2162ee2b1cf8d89686d1f9b59d2c4b8e55e217435e70b405e73d8645a4c75f616d80cbb932d2a93c0
SSDEEP:	12288:ijF9WMP0l64aOQ3p2K2pp4o1aCoaCoDVAcN2jWN9uq+V9mYxfY5fkR:ij2MPwc52h5YCXXjN2yD/+V9XNa6
TLSH:	A7F42350B2E45F12FABB9BB522968A219730B8CB5431DBDCDDD121CE51A1F01D6A2F0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B.................0.............F.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	526c6a52d0e4f047

Static PE Info

General

Entrypoint:	0x4ad246
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xECE1BD42 [Thu Dec 8 21:10:26 2095 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor al, 47h
inc ecx
inc edi
dec eax
inc ebp
xor eax, 484E3531h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], dh
push esp
xor eax, 43433753h
xor al, 52h
cmp byte ptr [00000000h], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xad1f3	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xae000	0x1b80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xad400	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xab93c	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xab26c	0xab400	080ed6a441b548d49a36bd1dee2effc1	False	0.9654539233576642	data	7.96453329112393	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xae000	0x1b80	0x1c00	b55871f696da632f0c30d95397a648f4	False	0.34988839285714285	data	5.579515054448806	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb0000	0xc	0x200	41336c745dd5e354f194e3be7ccdfbd5	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xae160	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.2675891181988743
RT_ICON	0xaf208	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5106382978723404
RT_GROUP_ICON	0xaf670	0x22	data	0.9411764705882353
RT_VERSION	0xaf694	0x300	MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"	0.4609375
RT_MANIFEST	0xaf994	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/23/24-14:23:35.363733	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49743	80	192.168.2.4	79.98.25.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 14:23:35.133434057 CEST	49743	80	192.168.2.4	79.98.25.1
Apr 23, 2024 14:23:35.360712051 CEST	80	49743	79.98.25.1	192.168.2.4
Apr 23, 2024 14:23:35.360879898 CEST	49743	80	192.168.2.4	79.98.25.1
Apr 23, 2024 14:23:35.363733053 CEST	49743	80	192.168.2.4	79.98.25.1
Apr 23, 2024 14:23:35.590857029 CEST	80	49743	79.98.25.1	192.168.2.4
Apr 23, 2024 14:23:35.592740059 CEST	80	49743	79.98.25.1	192.168.2.4
Apr 23, 2024 14:23:35.592761040 CEST	80	49743	79.98.25.1	192.168.2.4
Apr 23, 2024 14:23:35.592780113 CEST	80	49743	79.98.25.1	192.168.2.4
Apr 23, 2024 14:23:35.592797995 CEST	80	49743	79.98.25.1	192.168.2.4
Apr 23, 2024 14:23:35.592814922 CEST	80	49743	79.98.25.1	192.168.2.4
Apr 23, 2024 14:23:35.592840910 CEST	80	49743	79.98.25.1	192.168.2.4
Apr 23, 2024 14:23:35.592861891 CEST	49743	80	192.168.2.4	79.98.25.1
Apr 23, 2024 14:23:35.592941999 CEST	49743	80	192.168.2.4	79.98.25.1
Apr 23, 2024 14:23:35.592966080 CEST	49743	80	192.168.2.4	79.98.25.1
Apr 23, 2024 14:23:35.596626043 CEST	49743	80	192.168.2.4	79.98.25.1
Apr 23, 2024 14:23:35.823740959 CEST	80	49743	79.98.25.1	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 14:23:34.550977945 CEST	59465	53	192.168.2.4	1.1.1.1
Apr 23, 2024 14:23:35.118628979 CEST	53	59465	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 14:23:34.550977945 CEST	192.168.2.4	1.1.1.1	0x5dc3	Standard query (0)	www.maxiwalls.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 14:23:35.118628979 CEST	1.1.1.1	192.168.2.4	0x5dc3	No error (0)	www.maxiwalls.com		79.98.25.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.maxiwalls.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	79.98.25.1	80	4048	C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 14:23:35.363733053 CEST	468	OUT	GET /aleu/?lT2ltVXh=ok/gmcxpcerYYESV9LVelGsDrZokr4IbVWXcVokfXup7b9fdD39fjj06OXsQXJEXHKhiFziBALjD8i0StjfBb+96LAD/3UXNvlvrkMKLP/jNG9hi36bWzAk=&66=uX3d2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.maxiwalls.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Apr 23, 2024 14:23:35.592740059 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 12:23:35 GMT Server: Apache Cache-control: max-age=300 Vary: Accept-Encoding Content-Length: 5662 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 38 30 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 35 63 61 33 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 69 76 2e 6c 74 2f 69 6d 61 67 65 73 2f 74 68 75 6d 62 6e 61 69 6c 2e 70 6e 67 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 69 76 2e 6c 74 2f 69 6d 61 67 65 73 2f 74 68 75 6d 62 6e 61 69 6c 2e 70 6e 67 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 69 76 2e 6c 74 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 2e 70 6e 67 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 69 76 2e 6c 74 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 2e 70 6e 67 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 69 76 2e 6c 74 2f 64 65 66 61 75 6c 74 2e 63 73 73 22 3e 0d 0a 20 20 3c 74 69 74 6c 65 3e 6d 61 78 69 77 61 6c 6c 73 2e 63 6f 6d 20 2d 20 55 c5 be 72 65 67 69 73 74 72 75 6f 74 61 73 20 64 6f 6d 65 6e 61 73 20 2d 20 49 6e 74 65 72 6e 65 74 6f 20 76 69 7a 69 6a 61 3c 2f 74 69 74 6c 65 3e 0d 0a 20 3c 2f 68 65 61 64 3e 0d 0a 20 3c 62 6f 64 79 3e 0d 0a 0d 0a 3c 21 2d 2d 20 62 65 67 69 6e 20 68 65 61 64 65 72 20 2d 2d 3e 0d 0a 0d 0a 20 20 3c 74 61 62 6c 65 20 61 6c 69 67 6e 3d 63 65 6e 74 65 72 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 30 3e 0d 0a 20 20 20 3c 74 72 3e 0d 0a 20 20 20 20 3c 74 64 3e 0d 0a 20 20 20 20 20 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 69 76 2e 6c 74 2f 68 65 61 64 65 72 2e 68 74 6d 6c 22 20 77 69 64 74 68 3d 37 36 38 20 68 65 69 67 68 74 3d 31 30 30 20 73 63 72 6f 6c 6c 69 6e 67 3d 6e 6f 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 3e 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 74 64 3e 0d 0a 20 20 20 3c 2f 74 72 3e 0d 0a 20 20 20 3c 74 72 3e 3c 74 64 20 68 65 69 67 68 74 3d 32 34 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 0d 0a 20 20 3c 2f 74 61 62 6c 65 3e 0d 0a 0d 0a 3c 21 2d 2d 20 65 6e 64 20 68 65 61 64 65 72 20 2d 2d 3e 0d 0a 0d 0a 3c 21 2d 2d 20 62 65 67 69 6e 20 62 6f 64 79 20 2d 2d 3e 0d 0a 0d Data Ascii: <!doctype html><html> <head> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="robots" content="noindex, nofollow"> <meta name="viewport" content="width=800, maximum-scale=1"> <meta name="theme-color" content="#005ca3"> <meta itemprop="image" content="https://assets.iv.lt/images/thumbnail.png"> <meta property="og:image" content="https://assets.iv.lt/images/thumbnail.png"> <link rel="icon" sizes="96x96" href="https://assets.iv.lt/images/icon.png"> <link rel="apple-touch-icon" href="https://assets.iv.lt/images/icon.png"> <link rel="stylesheet" type="text/css" href="https://assets.iv.lt/default.css"> <title>maxiwalls.com - Uregistruotas domenas - Interneto vizija</title> </head> <body>... begin header --> <table align=center cellpadding=0 cellspacing=0> <tr> <td> <iframe src="https://assets.iv.lt/header.html" width=768 height=100 scrolling=no frameborder=0></iframe> </td> </tr> <tr><td height=24></td></tr> </table>... end header -->... begin body -->
Apr 23, 2024 14:23:35.592761040 CEST	1289	IN	Data Raw: 0a 20 20 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 37 36 38 20 61 6c 69 67 6e 3d 63 65 6e 74 65 72 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 30 3e 0d 0a 20 20 20 3c 74 72 3e 0d 0a 20 20 20 20 3c 74 64 3e 0d 0a Data Ascii: <table width=768 align=center cellpadding=0 cellspacing=0> <tr> <td> <h1>maxiwalls.com</h1> <p> </td> </tr> <tr valign=top> <td width=508> Domenas <b>maxiwalls.com</b> skmingai uregistruotas
Apr 23, 2024 14:23:35.592780113 CEST	1289	IN	Data Raw: c4 97 6d c4 97 2c 20 6b 61 64 20 c5 a1 69 61 6e 64 69 65 6e 20 70 61 73 20 6d 75 73 20 73 61 76 6f 20 69 6e 74 65 72 6e 65 74 6f 20 73 76 65 74 61 69 6e 65 73 20 74 61 6c 70 69 6e 61 20 69 72 20 6d 75 6d 69 73 20 70 61 73 69 74 69 6b 69 20 64 61 Data Ascii: m, kad iandien pas mus savo interneto svetaines talpina ir mumis pasitiki daugiausiai alies gyventoj. <p> <table class=table> <tr> <th></th> <th>Patui</th> <th>Svetainei</th> <th>U
Apr 23, 2024 14:23:35.592797995 CEST	1289	IN	Data Raw: 20 20 3c 74 64 3e 2b 3c 2f 74 64 3e 0d 0a 20 20 20 20 20 20 20 3c 74 64 3e 2b 3c 2f 74 64 3e 0d 0a 20 20 20 20 20 20 3c 2f 74 72 3e 0d 0a 20 20 20 20 20 20 3c 74 72 20 61 6c 69 67 6e 3d 63 65 6e 74 65 72 3e 0d 0a 20 20 20 20 20 20 20 3c 74 64 20 Data Ascii: <td>+</td> <td>+</td> </tr> <tr align=center> <td align=left>Reseller</td> <td>-</td> <td>-</td> <td>-</td> <td>+</td> </tr> <tr align=center> <td align=left
Apr 23, 2024 14:23:35.592814922 CEST	710	IN	Data Raw: 6c 69 3e 3c 61 20 74 61 72 67 65 74 3d 5f 74 6f 70 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 76 2e 6c 74 2f 70 72 6f 66 65 73 69 6f 6e 61 6c 75 73 2d 68 6f 73 74 69 6e 67 61 73 2f 22 3e 50 72 6f 66 65 73 69 6f 6e 61 6c 75 73 20 Data Ascii: li><a target=_top href="https://www.iv.lt/profesionalus-hostingas/">Profesionalus hostingas</a> <li><a target=_top href="https://www.iv.lt/vps-serveriai/">Serveri nuoma</a> <li><a target=_top href="https://www.iv.lt/sertifikata

Target ID:	0
Start time:	14:22:52
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe"
Imagebase:	0xec0000
File size:	723'464 bytes
MD5 hash:	73B6E5A11AFF9E7BD681B55136C5FBCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	14:22:54
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ 0400-ENPI-RQMA.exe"
Imagebase:	0x990000
File size:	723'464 bytes
MD5 hash:	73B6E5A11AFF9E7BD681B55136C5FBCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1927201157.0000000001300000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1927201157.0000000001300000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1926547005.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1926547005.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1928973003.00000000017E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1928973003.00000000017E0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	14:23:14
Start date:	23/04/2024
Path:	C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe"
Imagebase:	0x9b0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2896021580.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2896021580.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	14:23:15
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\replace.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\replace.exe"
Imagebase:	0x3b0000
File size:	18'944 bytes
MD5 hash:	A7F2E9DD9DE1396B1250F413DA2F6C08
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2175893456.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2175893456.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2175933717.0000000003020000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2175933717.0000000003020000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	14:23:28
Start date:	23/04/2024
Path:	C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\qFgkKdcrcNUsYBUTPurGEnMHfMasRAlTboeKQkbdiNEZEXHgzpjLlVBNYWEKR\KdcHSkcpIgYD.exe"
Imagebase:	0x9b0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2913084591.0000000004B50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.2913084591.0000000004B50000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	14:23:40
Start date:	23/04/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false