Loading ...

Play interactive tourEdit tour

Analysis Report Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe

Overview

General Information

Sample Name:Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
Analysis ID:356521
MD5:e6a6cb6ae013aa25b39d0cd53259ba9a
SHA1:dae3aaad039899d1d64f497115ac79227e98134a
SHA256:cb145909667bd181409f1e14b6b2fd00ec9f8894ffaba82bd2b1888065e6a22a
Tags:AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
Yara detected AntiVM_3
.NET source code contains potential unpacker
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Creates processes with suspicious names
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "W7bZHUORtY", "URL: ": "https://NixjAW2jY86MvLhZGpe.org", "To: ": "bilgi@ekonaz.com", "ByHost: ": "mail.ekonaz.com:587", "Password: ": "=0AkPO5K", "From: ": "bilgi@ekonaz.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.475618837.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000000.00000002.231189229.000000000454B000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        00000000.00000002.230634345.0000000004299000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000000.00000002.229999040.0000000003291000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
            Click to see the 6 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.3314b80.2.raw.unpackJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
              4.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                0.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.4565840.5.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  0.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.32c6c1c.1.raw.unpackJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
                    0.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.4565840.5.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 2 entries

                      Sigma Overview

                      System Summary:

                      barindex
                      Sigma detected: Suspicious Double ExtensionShow sources
                      Source: Process startedAuthor: Florian Roth (rule), @blu3_team (idea): Data: Command: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, CommandLine: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, CommandLine|base64offset|contains: j, Image: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, NewProcessName: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, OriginalFileName: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, ParentCommandLine: 'C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe' , ParentImage: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, ParentProcessId: 6492, ProcessCommandLine: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, ProcessId: 6828

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.6828.4.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "W7bZHUORtY", "URL: ": "https://NixjAW2jY86MvLhZGpe.org", "To: ": "bilgi@ekonaz.com", "ByHost: ": "mail.ekonaz.com:587", "Password: ": "=0AkPO5K", "From: ": "bilgi@ekonaz.com"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeVirustotal: Detection: 34%Perma Link
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeReversingLabs: Detection: 12%
                      Machine Learning detection for sampleShow sources
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeJoe Sandbox ML: detected
                      Source: 4.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8

                      Compliance:

                      barindex
                      Uses 32bit PE filesShow sources
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Contains modern PE file flags such as dynamic base (ASLR) or NXShow sources
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h0_2_07C3E7A8

                      Networking:

                      barindex
                      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                      Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49737 -> 188.40.67.173:587
                      C2 URLs / IPs found in malware configurationShow sources
                      Source: Malware configuration extractorURLs: https://NixjAW2jY86MvLhZGpe.org
                      Source: global trafficTCP traffic: 192.168.2.3:49737 -> 188.40.67.173:587
                      Source: Joe Sandbox ViewASN Name: HETZNER-ASDE HETZNER-ASDE
                      Source: global trafficTCP traffic: 192.168.2.3:49737 -> 188.40.67.173:587
                      Source: unknownDNS traffic detected: queries for: mail.ekonaz.com
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.481627688.0000000003411000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.481627688.0000000003411000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.481627688.0000000003411000.00000004.00000001.sdmpString found in binary or memory: http://GQZdzS.com
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.484207267.00000000036C5000.00000004.00000001.sdmpString found in binary or memory: http://mail.ekonaz.com
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.229754681.0000000001757000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comPt
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.229754681.0000000001757000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.come.comnt
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000003.214375004.00000000062BB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comn?
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000003.216059668.00000000062B1000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnrig
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000003.216059668.00000000062B1000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnthe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000003.216639218.00000000062AC000.00000004.00000001.sdmpString found in binary or memory: http://www.micro.
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000003.214678351.00000000062BB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com&
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.235673210.00000000074B2000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.484138351.00000000036BB000.00000004.00000001.sdmp, Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.481823032.0000000003441000.00000004.00000001.sdmp, Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.483795442.000000000365E000.00000004.00000001.sdmp, Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.484207267.00000000036C5000.00000004.00000001.sdmpString found in binary or memory: https://NixjAW2jY86MvLhZGpe.org
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.231189229.000000000454B000.00000004.00000001.sdmp, Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.475618837.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.481627688.0000000003411000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      Key, Mouse, Clipboard, Microphone and Screen Capturing:

                      barindex
                      Installs a global keyboard hookShow sources
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

                      System Summary:

                      barindex
                      .NET source code contains very large stringsShow sources
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, LogIn.csLong String: Length: 13656
                      Source: 0.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ef0000.0.unpack, LogIn.csLong String: Length: 13656
                      Source: 0.0.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ef0000.0.unpack, LogIn.csLong String: Length: 13656
                      Source: 4.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ec0000.1.unpack, LogIn.csLong String: Length: 13656
                      Source: 4.0.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ec0000.0.unpack, LogIn.csLong String: Length: 13656
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: initial sampleStatic PE information: Filename: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 0_2_030BB2640_2_030BB264
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 0_2_030BDF510_2_030BDF51
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 0_2_030BC2B00_2_030BC2B0
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 0_2_030B99900_2_030B9990
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_0179E4184_2_0179E418
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017913604_2_01791360
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017999904_2_01799990
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017A90504_2_017A9050
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017A70F04_2_017A70F0
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017ADA284_2_017ADA28
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017A45004_2_017A4500
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017A00404_2_017A0040
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017A00384_2_017A0038
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017A40E84_2_017A40E8
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017A52184_2_017A5218
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017A82B94_2_017A82B9
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017AAA804_2_017AAA80
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017ADC384_2_017ADC38
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_033946A04_2_033946A0
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_033946734_2_03394673
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_033946904_2_03394690
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000000.210005264.0000000000F78000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameHostExecutionContext.exe6 vs Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.236053664.00000000079D0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.236224099.0000000007BA0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameLegacyPathHandling.dllN vs Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.231189229.000000000454B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameqrSMwTlFYDYLDbvYrjZYQd.exe4 vs Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAsyncState.dllF vs Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.229999040.0000000003291000.00000004.00000001.sdmpBinary or memory string: OriginalFilename vs Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.476517073.0000000000F48000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameHostExecutionContext.exe6 vs Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.480070178.00000000017B0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.475618837.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameqrSMwTlFYDYLDbvYrjZYQd.exe4 vs Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.476608693.00000000012F8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeBinary or memory string: OriginalFilenameHostExecutionContext.exe6 vs Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, LogIn.csBase64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
                      Source: 0.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ef0000.0.unpack, LogIn.csBase64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
                      Source: 0.0.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ef0000.0.unpack, LogIn.csBase64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
                      Source: 4.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ec0000.1.unpack, LogIn.csBase64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
                      Source: 4.0.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ec0000.0.unpack, LogIn.csBase64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/1@1/1
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.logJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeMutant created: \Sessions\1\BaseNamedObjects\zSWSZUtKBCdvdTqtpl
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeVirustotal: Detection: 34%
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeReversingLabs: Detection: 12%
                      Source: unknownProcess created: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe 'C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe'
                      Source: unknownProcess created: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess created: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Data Obfuscation:

                      barindex
                      .NET source code contains potential unpackerShow sources
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, BoundHandle.cs.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 0.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ef0000.0.unpack, BoundHandle.cs.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 0.0.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ef0000.0.unpack, BoundHandle.cs.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 4.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ec0000.1.unpack, BoundHandle.cs.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 4.0.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.ec0000.0.unpack, BoundHandle.cs.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_01793BC4 push eax; iretd 4_2_01794B19
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.52192780554
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeFile created: \quotation-project at hor al anz cairo_012245666.pdf.exeJump to behavior

                      Hooking and other Techniques for Hiding and Protection:

                      barindex
                      Uses an obfuscated file name to hide its real file extension (double extension)Show sources
                      Source: Possible double extension: pdf.exeStatic PE information: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM_3Show sources
                      Source: Yara matchFile source: 00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.229999040.0000000003291000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe PID: 6492, type: MEMORY
                      Source: Yara matchFile source: 0.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.3314b80.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe.32c6c1c.1.raw.unpack, type: UNPACKEDPE
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeWindow / User API: threadDelayed 2602Jump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeWindow / User API: threadDelayed 7253Jump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe TID: 6496Thread sleep time: -103891s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe TID: 6512Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe TID: 2788Thread sleep time: -15679732462653109s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe TID: 5732Thread sleep count: 2602 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe TID: 5732Thread sleep count: 7253 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000003.449041345.0000000001478000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000000.00000002.230107764.0000000003312000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeCode function: 4_2_017A8950 LdrInitializeThunk,4_2_017A8950
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeMemory written: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeProcess created: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeJump to behavior
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.480713537.0000000001D20000.00000002.00000001.sdmpBinary or memory string: Program Manager
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.480713537.0000000001D20000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.480713537.0000000001D20000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe, 00000004.00000002.480713537.0000000001D20000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exeQueries volume informatio