Analysis Report Request for Quote.exe

Overview

General Information

Sample Name: Request for Quote.exe
Analysis ID: 356719
MD5: 40cb5c4488fff6e0c040ff45cba91ecf
SHA1: 0ea670f7c180a52cd18c0630feea996dbf6dcf77
SHA256: e9910e5698751eadaa69204411cd4cfe896148b60e71687ab0bd741e790d0488
Tags: exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
Yara detected AntiVM_3
.NET source code contains very large array initializations
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection:

barindex
Found malware configuration
Source: Request for Quote.exe.6376.5.memstr Malware Configuration Extractor: Agenttesla {"Username: ": "zaYbvzrtpFoig4F", "URL: ": "http://0hH44dwVeXbULYg.com", "To: ": "jayz@flagmonkey.com.au", "ByHost: ": "mail.flagmonkey.com.au:587", "Password: ": "dB7Urg", "From: ": "jayz@flagmonkey.com.au"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe ReversingLabs: Detection: 29%
Multi AV Scanner detection for submitted file
Source: Request for Quote.exe Virustotal: Detection: 28% Perma Link
Source: Request for Quote.exe ReversingLabs: Detection: 17%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Request for Quote.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 5.2.Request for Quote.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 20.2.Newapp.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\Request for Quote.exe Unpacked PE file: 0.2.Request for Quote.exe.280000.0.unpack
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Unpacked PE file: 14.2.Newapp.exe.a80000.0.unpack
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Unpacked PE file: 21.2.Newapp.exe.3f0000.0.unpack
Uses 32bit PE files
Source: Request for Quote.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: Request for Quote.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49740 -> 223.130.27.213:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49741 -> 223.130.27.213:587
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://0hH44dwVeXbULYg.com
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 223.130.27.213:587
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SYNERGYWHOLESALE-APSYNERGYWHOLESALEPTYLTDAU SYNERGYWHOLESALE-APSYNERGYWHOLESALEPTYLTDAU
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 223.130.27.213:587
Source: unknown DNS traffic detected: queries for: mail.flagmonkey.com.au
Source: Request for Quote.exe, 00000005.00000002.504112296.0000000003061000.00000004.00000001.sdmp, Request for Quote.exe, 00000005.00000002.506806990.000000000332D000.00000004.00000001.sdmp, Request for Quote.exe, 00000005.00000003.469692196.0000000001174000.00000004.00000001.sdmp String found in binary or memory: http://0hH44dwVeXbULYg.com
Source: Request for Quote.exe, 00000005.00000002.504112296.0000000003061000.00000004.00000001.sdmp, Newapp.exe, 00000014.00000002.503874782.0000000003431000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Newapp.exe, 00000014.00000002.503874782.0000000003431000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: Request for Quote.exe, 00000005.00000002.506698485.000000000331F000.00000004.00000001.sdmp String found in binary or memory: http://flagmonkey.com.au
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: Request for Quote.exe, 00000005.00000002.506698485.000000000331F000.00000004.00000001.sdmp String found in binary or memory: http://mail.flagmonkey.com.au
Source: Newapp.exe, 00000015.00000002.348199812.000000000291E000.00000004.00000001.sdmp String found in binary or memory: http://qunect.com/download/QuNect.exe
Source: Request for Quote.exe, 00000000.00000002.249097967.00000000025B1000.00000004.00000001.sdmp, Newapp.exe, 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp, Newapp.exe, 00000015.00000002.348199812.000000000291E000.00000004.00000001.sdmp String found in binary or memory: http://qunect.com/download/QuNect.exe&Operation
Source: Newapp.exe, 00000014.00000002.503874782.0000000003431000.00000004.00000001.sdmp String found in binary or memory: http://uHcRbL.com
Source: Request for Quote.exe, 00000000.00000002.249097967.00000000025B1000.00000004.00000001.sdmp, Newapp.exe, 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp, Newapp.exe, 00000015.00000002.348199812.000000000291E000.00000004.00000001.sdmp String found in binary or memory: http://validator.w3.org/check?uri=referer
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Request for Quote.exe, 00000000.00000003.233620527.0000000007A0C000.00000004.00000001.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Request for Quote.exe, 00000000.00000003.235651160.0000000007A0E000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers$h
Source: Request for Quote.exe, 00000000.00000003.235037233.0000000007A0E000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Request for Quote.exe, 00000000.00000003.235651160.0000000007A0E000.00000004.00000001.sdmp, Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Request for Quote.exe, 00000000.00000003.236228951.0000000007A0E000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers1
Source: Request for Quote.exe, 00000000.00000003.235651160.0000000007A0E000.00000004.00000001.sdmp, Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Request for Quote.exe, 00000000.00000003.236763631.0000000007A0E000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersb
Source: Request for Quote.exe, 00000000.00000002.253603269.00000000079DA000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: Request for Quote.exe, 00000000.00000002.253603269.00000000079DA000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comrsywa
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Request for Quote.exe, 00000000.00000003.232018672.0000000007A00000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn%u
Source: Request for Quote.exe, 00000000.00000003.232276547.00000000079FE000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/=v
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Request for Quote.exe, 00000000.00000003.237763152.0000000007A01000.00000004.00000001.sdmp, Request for Quote.exe, 00000000.00000003.237538687.0000000007A01000.00000004.00000001.sdmp, Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Request for Quote.exe, 00000000.00000003.233085403.00000000079D4000.00000004.00000001.sdmp, Request for Quote.exe, 00000000.00000003.233466028.00000000079D9000.00000004.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Request for Quote.exe, 00000000.00000003.233085403.00000000079D4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/-
Source: Request for Quote.exe, 00000000.00000003.233085403.00000000079D4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/U
Source: Request for Quote.exe, 00000000.00000003.233218699.00000000079DB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: Request for Quote.exe, 00000000.00000003.233085403.00000000079D4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/g
Source: Request for Quote.exe, 00000000.00000003.233085403.00000000079D4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Request for Quote.exe, 00000000.00000003.233466028.00000000079D9000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/U
Source: Request for Quote.exe, 00000000.00000003.233085403.00000000079D4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/n
Source: Request for Quote.exe, 00000000.00000003.232949267.00000000079D4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/n
Source: Request for Quote.exe, 00000000.00000003.233085403.00000000079D4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/x
Source: Request for Quote.exe, 00000000.00000003.235244456.0000000007A0E000.00000004.00000001.sdmp String found in binary or memory: http://www.monotype.
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Request for Quote.exe, 00000000.00000002.253700613.0000000007B40000.00000002.00000001.sdmp, Newapp.exe, 0000000E.00000002.351021009.00000000083F0000.00000002.00000001.sdmp, Newapp.exe, 00000015.00000002.351383146.0000000007DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Request for Quote.exe, 00000005.00000002.504112296.0000000003061000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%$
Source: Newapp.exe, 00000014.00000002.503874782.0000000003431000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: Request for Quote.exe, 00000000.00000002.249097967.00000000025B1000.00000004.00000001.sdmp, Newapp.exe, 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: Request for Quote.exe, 00000000.00000002.249616180.0000000003DB9000.00000004.00000001.sdmp, Request for Quote.exe, 00000005.00000002.495978831.0000000000402000.00000040.00000001.sdmp, Newapp.exe, 0000000E.00000002.346647833.0000000004839000.00000004.00000001.sdmp, Newapp.exe, 00000014.00000002.496055035.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Request for Quote.exe, 00000005.00000002.504112296.0000000003061000.00000004.00000001.sdmp, Newapp.exe, 00000014.00000002.503874782.0000000003431000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: Newapp.exe, 0000000E.00000002.343532586.0000000001178000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\Request for Quote.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary:

barindex
.NET source code contains very large array initializations
Source: 20.2.Newapp.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b55CF6D69u002d4E5Du002d4D68u002d8E88u002dF08D6C6E8534u007d/u0032F84C677u002d560Eu002d4E76u002d8A12u002d7C63DA2EDA80.cs Large array initialization: .cctor: array initializer size 11991
Detected potential crypto function
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02591028 0_2_02591028
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02592168 0_2_02592168
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_025917D0 0_2_025917D0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02592FE0 0_2_02592FE0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0259EC50 0_2_0259EC50
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02595318 0_2_02595318
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02595308 0_2_02595308
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_025950C8 0_2_025950C8
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_025950B9 0_2_025950B9
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02595798 0_2_02595798
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_025904D2 0_2_025904D2
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02595590 0_2_02595590
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02595581 0_2_02595581
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02594A50 0_2_02594A50
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02594A60 0_2_02594A60
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02593E90 0_2_02593E90
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02593EA0 0_2_02593EA0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02590F21 0_2_02590F21
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02592F9A 0_2_02592F9A
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02590F88 0_2_02590F88
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_045D0FC0 0_2_045D0FC0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_045D35E8 0_2_045D35E8
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_045D3C48 0_2_045D3C48
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_045D0040 0_2_045D0040
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_045D0006 0_2_045D0006
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0A9842F0 0_2_0A9842F0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0A984BB0 0_2_0A984BB0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0A984BC0 0_2_0A984BC0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0A984300 0_2_0A984300
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0AB93238 0_2_0AB93238
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0AB9782E 0_2_0AB9782E
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0AB93E88 0_2_0AB93E88
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0AB95DE8 0_2_0AB95DE8
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0AB95DD8 0_2_0AB95DD8
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0AB9C3F0 0_2_0AB9C3F0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_01416910 5_2_01416910
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_014161D8 5_2_014161D8
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_01415BA0 5_2_01415BA0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_0142822C 5_2_0142822C
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_0142EBD8 5_2_0142EBD8
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_014399A0 5_2_014399A0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_01436080 5_2_01436080
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_0143EAE8 5_2_0143EAE8
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_01430586 5_2_01430586
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_0143C668 5_2_0143C668
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_014371B0 5_2_014371B0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_0143F5C0 5_2_0143F5C0
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01572178 14_2_01572178
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01571028 14_2_01571028
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_015717E0 14_2_015717E0
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_0157EC50 14_2_0157EC50
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01572FE0 14_2_01572FE0
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01572168 14_2_01572168
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_015750C8 14_2_015750C8
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_015750B9 14_2_015750B9
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01575318 14_2_01575318
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01575308 14_2_01575308
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01575590 14_2_01575590
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01575581 14_2_01575581
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_015704D2 14_2_015704D2
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_015704E0 14_2_015704E0
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_015717D0 14_2_015717D0
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01575798 14_2_01575798
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_015757A8 14_2_015757A8
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01574A50 14_2_01574A50
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01574A60 14_2_01574A60
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01574D68 14_2_01574D68
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01570F21 14_2_01570F21
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01572F9A 14_2_01572F9A
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01570F88 14_2_01570F88
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01573E90 14_2_01573E90
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01573EA0 14_2_01573EA0
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FDFC68 14_2_02FDFC68
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FD82D0 14_2_02FD82D0
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FDA0B0 14_2_02FDA0B0
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FDA0A1 14_2_02FDA0A1
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FDC7B8 14_2_02FDC7B8
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FDC7A9 14_2_02FDC7A9
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FD8730 14_2_02FD8730
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FD8B48 14_2_02FD8B48
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FD8B38 14_2_02FD8B38
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FDCE30 14_2_02FDCE30
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FDCDF8 14_2_02FDCDF8
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_0967C350 14_2_0967C350
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_0967782E 14_2_0967782E
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_09675DE8 14_2_09675DE8
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_09675DDB 14_2_09675DDB
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_09673F88 14_2_09673F88
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_09701048 14_2_09701048
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_09700040 14_2_09700040
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_09700016 14_2_09700016
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 20_2_019B4860 20_2_019B4860
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 20_2_019B4790 20_2_019B4790
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 20_2_019BDBC0 20_2_019BDBC0
Sample file is different than original file name gathered from version info
Source: Request for Quote.exe Binary or memory string: OriginalFilename vs Request for Quote.exe
Source: Request for Quote.exe, 00000000.00000002.249097967.00000000025B1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameAsyncState.dllF vs Request for Quote.exe
Source: Request for Quote.exe, 00000000.00000002.249097967.00000000025B1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamedoOqGWMpIYencJvzbUkLaMlQGw.exe4 vs Request for Quote.exe
Source: Request for Quote.exe, 00000000.00000002.255811808.000000000ABA0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameLegacyPathHandling.dllN vs Request for Quote.exe
Source: Request for Quote.exe, 00000000.00000000.227538059.0000000000282000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameOpFlags.exe< vs Request for Quote.exe
Source: Request for Quote.exe, 00000000.00000002.254880635.000000000A9A0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs Request for Quote.exe
Source: Request for Quote.exe Binary or memory string: OriginalFilename vs Request for Quote.exe
Source: Request for Quote.exe, 00000005.00000002.497343586.0000000000C42000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameOpFlags.exe< vs Request for Quote.exe
Source: Request for Quote.exe, 00000005.00000002.511879488.0000000006390000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs Request for Quote.exe
Source: Request for Quote.exe, 00000005.00000002.495978831.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamedoOqGWMpIYencJvzbUkLaMlQGw.exe4 vs Request for Quote.exe
Source: Request for Quote.exe, 00000005.00000002.498162050.00000000010F8000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Request for Quote.exe
Source: Request for Quote.exe, 00000005.00000002.502647164.0000000001400000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamewshom.ocx.mui vs Request for Quote.exe
Source: Request for Quote.exe Binary or memory string: OriginalFilenameOpFlags.exe< vs Request for Quote.exe
Uses 32bit PE files
Source: Request for Quote.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Request for Quote.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Newapp.exe.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 20.2.Newapp.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 20.2.Newapp.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@15/4@2/1
Source: C:\Users\user\Desktop\Request for Quote.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Request for Quote.exe.log Jump to behavior
Source: Request for Quote.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Request for Quote.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Request for Quote.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Request for Quote.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Request for Quote.exe, 00000000.00000002.249097967.00000000025B1000.00000004.00000001.sdmp, Newapp.exe, 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Request for Quote.exe, 00000000.00000002.249097967.00000000025B1000.00000004.00000001.sdmp, Newapp.exe, 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: Request for Quote.exe Virustotal: Detection: 28%
Source: Request for Quote.exe ReversingLabs: Detection: 17%
Source: C:\Users\user\Desktop\Request for Quote.exe File read: C:\Users\user\Desktop\Request for Quote.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Request for Quote.exe 'C:\Users\user\Desktop\Request for Quote.exe'
Source: unknown Process created: C:\Users\user\Desktop\Request for Quote.exe C:\Users\user\Desktop\Request for Quote.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe 'C:\Users\user\AppData\Roaming\Newapp\Newapp.exe'
Source: unknown Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe 'C:\Users\user\AppData\Roaming\Newapp\Newapp.exe'
Source: C:\Users\user\Desktop\Request for Quote.exe Process created: C:\Users\user\Desktop\Request for Quote.exe C:\Users\user\Desktop\Request for Quote.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Request for Quote.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Request for Quote.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\Request for Quote.exe Unpacked PE file: 0.2.Request for Quote.exe.280000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Unpacked PE file: 14.2.Newapp.exe.a80000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Unpacked PE file: 21.2.Newapp.exe.3f0000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\Request for Quote.exe Unpacked PE file: 0.2.Request for Quote.exe.280000.0.unpack
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Unpacked PE file: 14.2.Newapp.exe.a80000.0.unpack
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Unpacked PE file: 21.2.Newapp.exe.3f0000.0.unpack
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_00285464 push 97205ACAh; retf 0_2_00285482
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_00283F94 push es; ret 0_2_00284004
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_002852D8 push ecx; retf 0_2_002852DD
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_00283FD6 push es; ret 0_2_00284004
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02596A6E push ecx; retf 0_2_02596A6F
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_02596D62 push F297BACAh; retf 0_2_02596D67
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 0_2_0AB9AFA0 push eax; ret 0_2_0AB9AFA1
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_00C43FD6 push es; ret 5_2_00C44004
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_00C42ED2 push ds; iretd 5_2_00C42EE0
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_00C452D8 push ecx; retf 5_2_00C452DD
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_00C42AEB push eax; retf 5_2_00C42AF8
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_00C43F94 push es; ret 5_2_00C44004
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_00C45464 push 97205ACAh; retf 5_2_00C45482
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_00C42E3B push 00000027h; retf 5_2_00C42E46
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_0141B5F7 push edi; retn 0000h 5_2_0141B5F9
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_00A83F94 push es; ret 14_2_00A84004
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_00A852D8 push ecx; retf 14_2_00A852DD
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_00A83FD6 push es; ret 14_2_00A84004
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_00A85464 push 97205ACAh; retf 14_2_00A85482
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01576A6E push ecx; retf 14_2_01576A6F
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_01576D62 push F297BACAh; retf 14_2_01576D67
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FD9ED1 push ecx; ret 14_2_02FD9EE5
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_02FD5FF4 push eax; iretd 14_2_02FD5FF5
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_0967AFA0 push eax; ret 14_2_0967AFA1
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 14_2_09704145 push FFFFFF8Bh; iretd 14_2_09704147
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 15_2_00282E3B push 00000027h; retf 15_2_00282E46
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 15_2_00285464 push 97205ACAh; retf 15_2_00285482
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 15_2_00283F94 push es; ret 15_2_00284004
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 15_2_00282AEB push eax; retf 15_2_00282AF8
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 15_2_002852D8 push ecx; retf 15_2_002852DD
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Code function: 15_2_00282ED2 push ds; iretd 15_2_00282EE0
Source: initial sample Static PE information: section name: .text entropy: 7.52597216215
Source: initial sample Static PE information: section name: .text entropy: 7.52597216215

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\Request for Quote.exe File created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Jump to dropped file
Source: C:\Users\user\Desktop\Request for Quote.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Newapp Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Newapp Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\Request for Quote.exe File opened: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Request for Quote.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM_3
Source: Yara match File source: 00000000.00000002.249097967.00000000025B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Newapp.exe PID: 996, type: MEMORY
Source: Yara match File source: Process Memory Space: Request for Quote.exe PID: 2260, type: MEMORY
Source: Yara match File source: 14.2.Newapp.exe.30abf98.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Request for Quote.exe.25e3b94.1.raw.unpack, type: UNPACKEDPE
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Request for Quote.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Request for Quote.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Request for Quote.exe, 00000000.00000002.249097967.00000000025B1000.00000004.00000001.sdmp, Newapp.exe, 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: Request for Quote.exe, 00000000.00000002.249097967.00000000025B1000.00000004.00000001.sdmp, Newapp.exe, 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Request for Quote.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Request for Quote.exe Window / User API: threadDelayed 5732 Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Window / User API: threadDelayed 4055 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Window / User API: threadDelayed 2972 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Window / User API: threadDelayed 6804 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Request for Quote.exe TID: 5512 Thread sleep time: -100587s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe TID: 5964 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe TID: 6744 Thread sleep time: -23980767295822402s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe TID: 6764 Thread sleep count: 5732 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe TID: 6764 Thread sleep count: 4055 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe TID: 6744 Thread sleep count: 32 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe TID: 1752 Thread sleep time: -100223s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe TID: 4012 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe TID: 4392 Thread sleep time: -20291418481080494s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe TID: 6972 Thread sleep count: 2972 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe TID: 6972 Thread sleep count: 6804 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe TID: 4392 Thread sleep count: 43 > 30 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Request for Quote.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Request for Quote.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: Newapp.exe, 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Newapp.exe, 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp Binary or memory string: vmware
Source: Newapp.exe, 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: Newapp.exe, 0000000E.00000002.345433821.000000000303E000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: C:\Users\user\Desktop\Request for Quote.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Request for Quote.exe Code function: 5_2_01410A76 KiUserExceptionDispatcher,KiUserExceptionDispatcher,KiUserExceptionDispatcher,LdrInitializeThunk, 5_2_01410A76
Enables debug privileges
Source: C:\Users\user\Desktop\Request for Quote.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Request for Quote.exe Memory written: C:\Users\user\Desktop\Request for Quote.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Memory written: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Request for Quote.exe Process created: C:\Users\user\Desktop\Request for Quote.exe C:\Users\user\Desktop\Request for Quote.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Process created: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Jump to behavior
Source: Request for Quote.exe, 00000005.00000002.503760793.0000000001950000.00000002.00000001.sdmp, Newapp.exe, 00000014.00000002.502802020.0000000001E80000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: Request for Quote.exe, 00000005.00000002.503760793.0000000001950000.00000002.00000001.sdmp, Newapp.exe, 00000014.00000002.502802020.0000000001E80000.00000002.00000001.sdmp Binary or memory string: Progman
Source: Request for Quote.exe, 00000005.00000002.503760793.0000000001950000.00000002.00000001.sdmp, Newapp.exe, 00000014.00000002.502802020.0000000001E80000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: Request for Quote.exe, 00000005.00000002.503760793.0000000001950000.00000002.00000001.sdmp, Newapp.exe, 00000014.00000002.502802020.0000000001E80000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: Request for Quote.exe, 00000005.00000002.503760793.0000000001950000.00000002.00000001.sdmp, Newapp.exe, 00000014.00000002.502802020.0000000001E80000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Users\user\Desktop\Request for Quote.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Users\user\Desktop\Request for Quote.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Newapp\Newapp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000014.00000002.496055035.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.503874782.0000000003431000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.504112296.0000000003061000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.249616180.0000000003DB9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.495978831.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.346647833.0000000004839000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Newapp.exe PID: 996, type: MEMORY
Source: Yara match File source: Process Memory Space: Request for Quote.exe PID: 2260, type: MEMORY
Source: Yara match File source: Process Memory Space: Newapp.exe PID: 6108, type: MEMORY
Source: Yara match File source: Process Memory Space: Request for Quote.exe PID: 6376, type: MEMORY
Source: Yara match File source: 14.2.Newapp.exe.4a1e1a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Request for Quote.exe.3ecf990.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Request for Quote.exe.3ecf990.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Request for Quote.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.Newapp.exe.4b44450.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.Newapp.exe.4b44450.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.Newapp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.Newapp.exe.49b6d80.3.raw.unpack, type: UNPACKEDPE
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\Request for Quote.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Request for Quote.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\Request for Quote.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\Request for Quote.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000014.00000002.503874782.0000000003431000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.504112296.0000000003061000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Newapp.exe PID: 6108, type: MEMORY
Source: Yara match File source: Process Memory Space: Request for Quote.exe PID: 6376, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000014.00000002.496055035.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.503874782.0000000003431000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.504112296.0000000003061000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.249616180.0000000003DB9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.495978831.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.346647833.0000000004839000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Newapp.exe PID: 996, type: MEMORY
Source: Yara match File source: Process Memory Space: Request for Quote.exe PID: 2260, type: MEMORY
Source: Yara match File source: Process Memory Space: Newapp.exe PID: 6108, type: MEMORY
Source: Yara match File source: Process Memory Space: Request for Quote.exe PID: 6376, type: MEMORY
Source: Yara match File source: 14.2.Newapp.exe.4a1e1a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Request for Quote.exe.3ecf990.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Request for Quote.exe.3ecf990.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Request for Quote.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.Newapp.exe.4b44450.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.Newapp.exe.4b44450.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.Newapp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.Newapp.exe.49b6d80.3.raw.unpack, type: UNPACKEDPE
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 356719 Sample: Request for Quote.exe Startdate: 23/02/2021 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Found malware configuration 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 10 other signatures 2->51 6 Request for Quote.exe 3 2->6         started        10 Newapp.exe 3 2->10         started        12 Newapp.exe 2 2->12         started        process3 file4 27 C:\Users\user\...\Request for Quote.exe.log, ASCII 6->27 dropped 53 Injects a PE file into a foreign processes 6->53 14 Request for Quote.exe 2 5 6->14         started        55 Multi AV Scanner detection for dropped file 10->55 57 Detected unpacking (changes PE section rights) 10->57 59 Detected unpacking (overwrites its own PE header) 10->59 61 3 other signatures 10->61 19 Newapp.exe 2 10->19         started        21 Newapp.exe 10->21         started        23 Newapp.exe 10->23         started        25 2 other processes 10->25 signatures5 process6 dnsIp7 33 flagmonkey.com.au 223.130.27.213, 49740, 49741, 587 SYNERGYWHOLESALE-APSYNERGYWHOLESALEPTYLTDAU Australia 14->33 35 mail.flagmonkey.com.au 14->35 29 C:\Users\user\AppData\Roaming\...29ewapp.exe, PE32 14->29 dropped 31 C:\Users\user\...31ewapp.exe:Zone.Identifier, ASCII 14->31 dropped 37 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->37 39 Tries to steal Mail credentials (via file access) 14->39 41 Tries to harvest and steal ftp login credentials 14->41 43 2 other signatures 14->43 file8 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
223.130.27.213
unknown Australia
45638 SYNERGYWHOLESALE-APSYNERGYWHOLESALEPTYLTDAU true

Contacted Domains

Name IP Active
flagmonkey.com.au 223.130.27.213 true
mail.flagmonkey.com.au unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://0hH44dwVeXbULYg.com true
  • Avira URL Cloud: safe
unknown